System	Score	Found at
cvssv3	6.5	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000385.json
epss	0.72934	https://api.first.org/data/v1/epss?cve=CVE-2017-1000385
epss	0.72934	https://api.first.org/data/v1/epss?cve=CVE-2017-1000385
epss	0.83282	https://api.first.org/data/v1/epss?cve=CVE-2017-1000385
epss	0.83282	https://api.first.org/data/v1/epss?cve=CVE-2017-1000385
epss	0.83282	https://api.first.org/data/v1/epss?cve=CVE-2017-1000385
epss	0.83282	https://api.first.org/data/v1/epss?cve=CVE-2017-1000385
epss	0.83282	https://api.first.org/data/v1/epss?cve=CVE-2017-1000385
epss	0.83282	https://api.first.org/data/v1/epss?cve=CVE-2017-1000385
epss	0.83282	https://api.first.org/data/v1/epss?cve=CVE-2017-1000385
cvssv2	6.1	https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3	6.5	https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

Reference id	Reference type	URL
		https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000385.json
		https://api.first.org/data/v1/epss?cve=CVE-2017-1000385
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000385
		https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1520400		https://bugzilla.redhat.com/show_bug.cgi?id=1520400
RHSA-2018:0242		https://access.redhat.com/errata/RHSA-2018:0242
RHSA-2018:0303		https://access.redhat.com/errata/RHSA-2018:0303
RHSA-2018:0368		https://access.redhat.com/errata/RHSA-2018:0368
RHSA-2018:0528		https://access.redhat.com/errata/RHSA-2018:0528
USN-3571-1		https://usn.ubuntu.com/3571-1/

Data source	Metasploit
Description	Some TLS implementations handle errors processing RSA key exchanges and encryption (PKCS #1 v1.5 messages) in a broken way that leads an adaptive chosen-chiphertext attack. Attackers cannot recover a server's private key, but they can decrypt and sign messages with it. A strong oracle occurs when the TLS server does not strictly check message formatting and needs less than a million requests on average to decode a given ciphertext. A weak oracle server strictly checks message formatting and often requires many more requests to perform the attack. This module requires Python 3 with the gmpy2 and cryptography packages to be present.
Note	AKA: - ROBOT - Adaptive chosen-ciphertext attack
Ransomware campaign use	Unknown
Source publication date	June 17, 2009
Source URL	https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000385.json

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Vector: AV:N/AC:H/Au:N/C:C/I:P/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

Exploitability (E)	Access Vector (AV)	Access Complexity (AC)	Authentication (Au)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
high functional unproven proof_of_concept not_defined	local adjacent_network network	high medium low	multiple single none	none partial complete	none partial complete	none partial complete

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Percentile	0.98731
EPSS Score	0.72934
Published At	Aug. 3, 2025, 12:55 p.m.

Date	Actor	Action	Source	VulnerableCode Version
2025-07-31T08:35:56.734439+00:00	Ubuntu USN Importer	Import	https://usn.ubuntu.com/3571-1/	37.0.0