CVE-2015-0285: The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is...

Security readout for executives and security teams

OpenSSL 1.0.2 before 1.0.2a could begin a client TLS handshake before its random number generator was properly seeded. That weakens the cryptographic assumptions of the connection. The public description requires network sniffing and brute-force effort; the bundle does not show known active exploitation. Exposure is most likely where OpenSSL 1.0.2 is used in client TLS functionality and has not been updated to 1.0.2a or a vendor-fixed build. Downstream vendor advisories indicate embedded or packaged OpenSSL may also matter. Treat this as a targeted remediation item for legacy OpenSSL rather than a crisis. It affects cryptographic trust, but the bundle shows no KEV listing or active exploitation claim. Fix during normal vulnerability management, faster for sensitive or exposed environments. Mitigation focus: Upgrade OpenSSL 1.0.2 deployments to 1.0.2a or later vendor-fixed builds.; Check OS, appliance, and application vendor advisories for bundled OpenSSL updates.; Prioritize internet-facing and sensitive-data client TLS use cases..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.