VulnerabilityModified

CVE-2014-0224

HIGH 7.4EPSS 95.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 95.3%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

CVSS 3.1: 7.4 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 95.33% probability · 100th percentile
CISA KEV: Not listed
Weakness: CWE-326
Affected: openssl/openssl · redhat/jboss enterprise application platform · redhat/jboss enterprise web platform · redhat/jboss enterprise web server · redhat/storage · fedoraproject/fedora · opensuse/opensuse · redhat/enterprise linux · filezilla-project/filezilla server · siemens/application processing engine firmware · siemens/cp1543-1 firmware · siemens/s7-1500 firmware · siemens/rox firmware · mariadb/mariadb · python/python · nodejs/node.js
Source: secalert@redhat.com

References

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.ascThird Party Advisory
http://ccsinjection.lepidum.co.jpThird Party Advisory
http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.htmlThird Party Advisory
http://esupport.trendmicro.com/solution/en-US/1103813.aspxThird Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629Not Applicable
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195Not Applicable
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29217Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-1053.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-02/msg00030.htmlThird Party Advisory
http://marc.info/?l=bugtraq&m=140266410314613&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140317760000786&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140369637402535&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140386311427810&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140389274407904&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140389355508263&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140431828824371&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140448122410568&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140482916501310&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140491231331543&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140499864129699&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140544599631400&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140604261522465&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140621259019789&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140672208601650&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=140752315422991&w=2Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.