CVE-2014-3510

medium · 4.3

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.

4.3

CVSS

17.9%

EPSS (exploit prob.)

97th

EPSS percentile

2014-08-13

Published

AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

Vendor	Product	Affected versions
openssl	openssl	0.9.8
openssl	openssl	0.9.8a
openssl	openssl	0.9.8b
openssl	openssl	0.9.8c
openssl	openssl	0.9.8d
openssl	openssl	0.9.8e
openssl	openssl	0.9.8f
openssl	openssl	0.9.8g
openssl	openssl	0.9.8h
openssl	openssl	0.9.8i
openssl	openssl	0.9.8j
openssl	openssl	0.9.8k
openssl	openssl	0.9.8l
openssl	openssl	0.9.8m
openssl	openssl	0.9.8m
openssl	openssl	0.9.8n
openssl	openssl	0.9.8o
openssl	openssl	0.9.8p
openssl	openssl	0.9.8q
openssl	openssl	0.9.8r
openssl	openssl	0.9.8s
openssl	openssl	0.9.8t
openssl	openssl	0.9.8u
openssl	openssl	0.9.8v
openssl	openssl	0.9.8w
openssl	openssl	0.9.8x
openssl	openssl	0.9.8y
openssl	openssl	0.9.8za
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0a
openssl	openssl	1.0.0b
openssl	openssl	1.0.0c
openssl	openssl	1.0.0d
openssl	openssl	1.0.0e
openssl	openssl	1.0.0f

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3510