CVE-2014-3470

medium · 4.3

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

4.3

CVSS

85.8%

EPSS (exploit prob.)

100th

EPSS percentile

2014-06-05

Published

AV:N/AC:M/Au:N/C:N/I:N/A:P

Weaknesses

CWE-476

Affected products

Vendor	Product	Affected versions
openssl	openssl	< 0.9.8za
openssl	openssl	>= 1.0.0, < 1.0.0m
openssl	openssl	>= 1.0.1, < 1.0.1h
redhat	storage	2.1
fedoraproject	fedora	all versions
redhat	enterprise_linux	5
redhat	enterprise_linux	6.0
mariadb	mariadb	>= 10.0.0, < 10.0.13
fedoraproject	fedora	19
fedoraproject	fedora	20
opensuse	leap	42.1
opensuse	opensuse	13.2
suse	linux_enterprise_desktop	12
suse	linux_enterprise_server	12
suse	linux_enterprise_software_development_kit	12
suse	linux_enterprise_workstation_extension	12

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3470