CVE-2014-0221

medium · 4.3

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

4.3

CVSS

87.9%

EPSS (exploit prob.)

100th

EPSS percentile

2014-06-05

Published

AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

Vendor	Product	Affected versions
openssl	openssl	>= 0.9.8, < 0.9.8za
openssl	openssl	>= 1.0.0, < 1.0.0m
openssl	openssl	>= 1.0.1, < 1.0.1h
redhat	storage	2.1
fedoraproject	fedora	all versions
redhat	enterprise_linux	5
redhat	enterprise_linux	6.0
mariadb	mariadb	>= 10.0.0, < 10.0.13
fedoraproject	fedora	19
fedoraproject	fedora	20
opensuse	leap	42.1
opensuse	opensuse	13.2
suse	linux_enterprise_desktop	12
suse	linux_enterprise_server	12
suse	linux_enterprise_software_development_kit	12
suse	linux_enterprise_workstation_extension	12

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-0221