CVE-2014-3511

medium · 4.3

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.

4.3

CVSS

14.1%

EPSS (exploit prob.)

96th

EPSS percentile

2014-08-13

Published

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

Vendor	Product	Affected versions
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0a
openssl	openssl	1.0.0b
openssl	openssl	1.0.0c
openssl	openssl	1.0.0d
openssl	openssl	1.0.0e
openssl	openssl	1.0.0f
openssl	openssl	1.0.0g
openssl	openssl	1.0.0h
openssl	openssl	1.0.0i
openssl	openssl	1.0.0j
openssl	openssl	1.0.0k
openssl	openssl	1.0.0l
openssl	openssl	1.0.0m
openssl	openssl	1.0.1
openssl	openssl	1.0.1
openssl	openssl	1.0.1
openssl	openssl	1.0.1
openssl	openssl	1.0.1a
openssl	openssl	1.0.1b
openssl	openssl	1.0.1c
openssl	openssl	1.0.1d
openssl	openssl	1.0.1e
openssl	openssl	1.0.1f
openssl	openssl	1.0.1g
openssl	openssl	1.0.1h

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3511