Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-0224


OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.


Published

2014-06-05T21:55:07.817

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 7.4 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-326

Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application openssl openssl < 0.9.8za Yes
Application openssl openssl < 1.0.0m Yes
Application openssl openssl < 1.0.1h Yes
Application redhat jboss_enterprise_application_platform 5.2.0 Yes
Application redhat jboss_enterprise_application_platform 6.2.3 Yes
Application redhat jboss_enterprise_web_platform 5.2.0 Yes
Application redhat jboss_enterprise_web_server 2.0.1 Yes
Application redhat storage 2.1 Yes
Operating System fedoraproject fedora 19 Yes
Operating System fedoraproject fedora 20 Yes
Operating System opensuse opensuse 13.1 Yes
Operating System opensuse opensuse 13.2 Yes
Operating System redhat enterprise_linux 4 Yes
Operating System redhat enterprise_linux 5 Yes
Operating System redhat enterprise_linux 6.0 Yes
Application filezilla-project filezilla_server < 0.9.45 Yes
Operating System siemens application_processing_engine_firmware < 2.0.2 Yes
Hardware siemens application_processing_engine - No
Operating System siemens cp1543-1_firmware < 1.1.25 Yes
Hardware siemens cp1543-1 - No
Operating System siemens s7-1500_firmware < 1.6 Yes
Hardware siemens s7-1500 - No
Operating System siemens rox_firmware < 1.16.1 Yes
Hardware siemens rox - No
Application mariadb mariadb < 10.0.13 Yes
Application python python < 2.7.8 Yes
Application python python < 3.4.2 Yes
Application nodejs node.js < 0.10.29 Yes

References