CVEvulnerability

CVE-2014-0224

7.4 HIGH Published 2014-06-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-06-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-326

Description

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Affected configurations

• openssl openssl (< 0.9.8za) • openssl openssl (>= 1.0.0 < 1.0.0m) • openssl openssl (>= 1.0.1 < 1.0.1h) • redhat jboss enterprise application platform 5.2.0 • redhat jboss enterprise application platform 6.2.3 • redhat jboss enterprise web platform 5.2.0 • redhat jboss enterprise web server 2.0.1 • redhat storage 2.1 • fedoraproject fedora 19 • fedoraproject fedora 20 • opensuse opensuse 13.1 • opensuse opensuse 13.2 • redhat enterprise linux 4 • redhat enterprise linux 5 • redhat enterprise linux 6.0 • filezilla-project filezilla server (< 0.9.45) • siemens application processing engine firmware (< 2.0.2) • siemens cp1543-1 firmware (< 1.1.25) • siemens s7-1500 firmware (< 1.6) • siemens rox firmware (< 1.16.1) • mariadb mariadb (>= 10.0.0 < 10.0.13) • python python (>= 2.7.0 < 2.7.8) • python python (>= 3.4.0 < 3.4.2) • nodejs node.js (< 0.10.29)

Related

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References