{"id":"CVE-2014-0224","url":"https://www.cyber-defence.io/tools/cve/CVE-2014-0224","generatedAt":"2026-11-05T07:06:49.122Z","title":"OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL…","description":"OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the \"CCS Injection\" vulnerability.","published":"2014-06-05T21:55:08.000Z","lastModified":"2026-06-17T00:02:34.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"cwe":["CWE-326"],"affected":["openssl/openssl","redhat/jboss enterprise application platform","redhat/jboss enterprise web platform","redhat/jboss enterprise web server","redhat/storage","fedoraproject/fedora","opensuse/opensuse","redhat/enterprise linux","filezilla-project/filezilla server","siemens/application processing engine firmware","siemens/cp1543-1 firmware","siemens/s7-1500 firmware","siemens/rox firmware","mariadb/mariadb","python/python","nodejs/node.js"],"epss":{"score":0.95326,"percentile":0.99866,"date":"2026-11-04","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 95.3%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://ccsinjection.lepidum.co.jp","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://esupport.trendmicro.com/solution/en-US/1103813.aspx","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629","tags":["Not Applicable"],"source":"secalert@redhat.com"},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195","tags":["Not Applicable"],"source":"secalert@redhat.com"},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=KB29217","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://linux.oracle.com/errata/ELSA-2014-1053.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-updates/2015-02/msg00030.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140266410314613&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140317760000786&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140369637402535&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140386311427810&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140389274407904&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140389355508263&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140431828824371&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140448122410568&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140482916501310&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140491231331543&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140499864129699&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140544599631400&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140604261522465&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140621259019789&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140672208601650&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140752315422991&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140784085708882&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140794476212181&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140852757108392&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140852826008699&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140870499402361&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140904544427729&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=140983229106599&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=141025641601169&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=141147110427269&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=141164638606214&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=141383410222440&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=141383465822787&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=141658880509699&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=142350350616251&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=142546741516006&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=142805027510172&w=2","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://puppetlabs.com/security/cve/cve-2014-0224","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0624.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0626.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0627.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0630.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0631.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0632.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0633.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0680.html","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://seclists.org/fulldisclosure/2014/Dec/23","tags":["Mailing List","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://seclists.org/fulldisclosure/2014/Jun/38","tags":["Mailing List","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/58128","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/58337","tags":["Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/58385","tags":["Third Party Advisory"],"source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-0224","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}