VulnerabilityModified

CVE-2014-0224

HIGH 7.4EPSS 95.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 95.3%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

CVSS 3.1: 7.4 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 95.33% probability · 100th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-326
Affected: openssl/openssl · redhat/jboss enterprise application platform · redhat/jboss enterprise web platform · redhat/jboss enterprise web server · redhat/storage · fedoraproject/fedora · opensuse/opensuse · redhat/enterprise linux · filezilla-project/filezilla server · siemens/application processing engine firmware · siemens/cp1543-1 firmware · siemens/s7-1500 firmware · siemens/rox firmware · mariadb/mariadb · python/python · nodejs/node.js
Source: secalert@redhat.com

EPSS trend

EPSS 95.3% since 4 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.ascThird Party Advisory
http://ccsinjection.lepidum.co.jpThird Party Advisory
http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.htmlThird Party Advisory
http://esupport.trendmicro.com/solution/en-US/1103813.aspxThird Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629Not Applicable
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195Not Applicable
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29217Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-1053.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-02/msg00030.htmlThird Party Advisory
http://marc.info/?l=bugtraq&m=140266410314613&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140317760000786&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140369637402535&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140386311427810&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140389274407904&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140389355508263&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140431828824371&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140448122410568&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140482916501310&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140491231331543&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140499864129699&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140544599631400&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140604261522465&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140621259019789&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140672208601650&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140752315422991&w=2Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.