DROWNAttack
DROWN Attack is a security vulnerability in some TLS and SSL servers. Its full name is Decrypting RSA with Obsolete and Weakened eNcryption, and it is sometimes referred to by the acronym DROWN. The attack arises when a server supports the older SSLv2 protocol and shares an RSA private key with other servers that handle TLS connections. Under these conditions, an attacker who can observe network traffic to the TLS service may be able to decrypt otherwise encrypted communications.
In practical terms, the DROWN vulnerability relies on cross-protocol weaknesses between SSLv2 and modern TLS services
The vulnerability was disclosed publicly in 2016. It prompted widespread advisories and software updates as many
Mitigation strategies focus on removing SSLv2 support, avoiding RSA key exchange vulnerabilities, and practicing strict key