CVE-2014-0224

high · 7.4

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

7.4

CVSS

95.3%

EPSS (exploit prob.)

100th

EPSS percentile

2014-06-05

Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-326

Affected products

Vendor	Product	Affected versions
openssl	openssl	< 0.9.8za
openssl	openssl	>= 1.0.0, < 1.0.0m
openssl	openssl	>= 1.0.1, < 1.0.1h
redhat	jboss_enterprise_application_platform	5.2.0
redhat	jboss_enterprise_application_platform	6.2.3
redhat	jboss_enterprise_web_platform	5.2.0
redhat	jboss_enterprise_web_server	2.0.1
redhat	storage	2.1
fedoraproject	fedora	19
fedoraproject	fedora	20
opensuse	opensuse	13.1
opensuse	opensuse	13.2
redhat	enterprise_linux	4
redhat	enterprise_linux	5
redhat	enterprise_linux	6.0
filezilla-project	filezilla_server	< 0.9.45
siemens	application_processing_engine_firmware	< 2.0.2
siemens	application_processing_engine	all versions
siemens	cp1543-1_firmware	< 1.1.25
siemens	cp1543-1	all versions
siemens	s7-1500_firmware	< 1.6
siemens	s7-1500	all versions
siemens	rox_firmware	< 1.16.1
siemens	rox	all versions
mariadb	mariadb	>= 10.0.0, < 10.0.13
python	python	>= 2.7.0, < 2.7.8
python	python	>= 3.4.0, < 3.4.2
nodejs	node.js	< 0.10.29

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-0224