{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T07:01:56Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"cisco-sa-20171212-bleichenbacher","slug":"cisco-sa-20171212-bleichenbacher","vendor":"Cisco","title":"Bleichenbacher Attack on TLS Affecting Cisco Products: December 2017","summary":"On December 12, 2017, a research paper with the title Return of Bleichenbacher's Oracle Threat was made publicly available. This paper describes how some Transport Layer Security (TLS) stacks are vulnerable to variations of the classic Bleichenbacher attack on RSA key exchange. Multiple vulnerabilities were identified based on this research. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions. To exploit these vulnerabilities, an attacker must be able to perform both of the following actions: Capture traffic between clients and the affected TLS server. Actively establish a considerable number of TLS connections to the vulnerable server. The actual number of connections required varies with the implementation-specific vulnerabilities, and could range from hundreds of thousands to millions of connections. Multiple Cisco products are affected by these vulnerabilities. Cisco has released software updates that address some of these vulnerabilities. There may be workarounds available for selected products. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","severity":"Medium","published_at":"2017-12-12T15:45:00Z","updated_at":"2018-05-18T17:31:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher/csaf/cisco-sa-20171212-bleichenbacher.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":3,"visible_product_count":9,"public_evidence_count":9,"kev_count":0,"highest_epss":0.14823},"cves":[{"id":"CVE-2017-17428","kev":false,"epss":{"score":0.14823,"percentile":0.96317,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"}},{"id":"CVE-2017-12373","kev":false,"epss":{"score":0.12798,"percentile":0.95848,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:47Z"}},{"id":"CVE-2017-15533","kev":false}],"public_evidence":[{"product":{"name":"Cisco ACE Application Control Engine Module","slug":"cisco-ace-application-control-engine-module","vendor":"Cisco"},"cve":{"id":"CVE-2017-17428"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-19T22:15:37Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco ACE Application Control Engine Module","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.14823,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2017-12-12T15:45:00Z","updated_at":"2018-05-18T17:31:00Z","advisory_updated_at":"2018-05-18T17:31:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","row_display_order":1},{"product":{"name":"Cisco ACE 4700 Series Application Control Engine Appliances","slug":"cisco-ace-4700-series-application-control-engine-appliances","vendor":"Cisco"},"cve":{"id":"CVE-2017-17428"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-19T22:15:37Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco ACE 4700 Series Application Control Engine Appliances","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.14823,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2017-12-12T15:45:00Z","updated_at":"2018-05-18T17:31:00Z","advisory_updated_at":"2018-05-18T17:31:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","row_display_order":2},{"product":{"name":"Cisco Webex Meetings","slug":"cisco-webex-meetings","vendor":"Cisco"},"cve":{"id":"CVE-2017-17428"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-19T22:15:37Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Webex Meetings","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.14823,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2017-12-12T15:45:00Z","updated_at":"2018-05-18T17:31:00Z","advisory_updated_at":"2018-05-18T17:31:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","row_display_order":3},{"product":{"name":"Cisco WebEx Meeting Center","slug":"cisco-webex-meeting-center","vendor":"Cisco"},"cve":{"id":"CVE-2017-17428"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-19T22:15:37Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco WebEx Meeting Center","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.14823,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2017-12-12T15:45:00Z","updated_at":"2018-05-18T17:31:00Z","advisory_updated_at":"2018-05-18T17:31:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","row_display_order":4},{"product":{"name":"Cisco WebEx Event Center","slug":"cisco-webex-event-center","vendor":"Cisco"},"cve":{"id":"CVE-2017-17428"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-19T22:15:37Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco WebEx Event Center","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.14823,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2017-12-12T15:45:00Z","updated_at":"2018-05-18T17:31:00Z","advisory_updated_at":"2018-05-18T17:31:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","row_display_order":5},{"product":{"name":"Cisco WebEx Training Center","slug":"cisco-webex-training-center","vendor":"Cisco"},"cve":{"id":"CVE-2017-17428"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-19T22:15:37Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco WebEx Training Center","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.14823,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2017-12-12T15:45:00Z","updated_at":"2018-05-18T17:31:00Z","advisory_updated_at":"2018-05-18T17:31:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","row_display_order":6},{"product":{"name":"Cisco WebEx Support Center","slug":"cisco-webex-support-center","vendor":"Cisco"},"cve":{"id":"CVE-2017-17428"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-19T22:15:37Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco WebEx Support Center","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.14823,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2017-12-12T15:45:00Z","updated_at":"2018-05-18T17:31:00Z","advisory_updated_at":"2018-05-18T17:31:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","row_display_order":7},{"product":{"name":"Cisco WebEx Connect","slug":"cisco-webex-connect","vendor":"Cisco"},"cve":{"id":"CVE-2017-17428"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-19T22:15:37Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco WebEx Connect","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.14823,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:33Z"},"published_at":"2017-12-12T15:45:00Z","updated_at":"2018-05-18T17:31:00Z","advisory_updated_at":"2018-05-18T17:31:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","row_display_order":8},{"product":{"name":"Cisco Adaptive Security Appliance (ASA) Software","slug":"cisco-adaptive-security-appliance-asa-software","vendor":"Cisco"},"cve":{"id":"CVE-2017-12373"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-19T22:15:37Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Adaptive Security Appliance (ASA) Software","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.12798,"score_date":"2026-07-19","updated_at":"2026-07-20T05:46:47Z"},"published_at":"2017-12-12T15:45:00Z","updated_at":"2018-05-18T17:31:00Z","advisory_updated_at":"2018-05-18T17:31:00Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher","row_display_order":9}]}