Maple Labs

CVE search · CVE-2014-0224

CVE-2014-0224

high 7.4

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
secalert@redhat.com
Weakness
CWE-326

Severity

VersionScoreVectorSource
CVSS 3.1 high 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N nvd@nist.govPrimary
CVSS 2.0 medium 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References