CVE-2014-0224
High
Description
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.
SeverityHigh
CVSS7.4
Exploit probability100. percentile95.3%
Product
Openssl
PublishedJun 5, 2014
First seenJun 5, 2014
How to fix
Update
- openssl openssl0.9.8za, 1.0.0m, 1.0.1h or later
- filezilla-project filezilla_server0.9.45 or later
- siemens application_processing_engine_firmware2.0.2 or later
- siemens cp1543-1_firmware1.1.25 or later
- siemens s7-1500_firmware1.6 or later
- siemens rox_firmware1.16.1 or later
- mariadb mariadb10.0.13 or later
- python python2.7.8, 3.4.2 or later
- nodejs node.js0.10.29 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openssl openssl | v < 0.9.8za, 1.0.0 ≤ v < 1.0.0m, 1.0.1 ≤ v < 1.0.1h | 0.9.8za, 1.0.0m, 1.0.1h |
| redhat jboss_enterprise_application_platform | 5.2.0, 6.2.3 | — |
| redhat jboss_enterprise_web_platform | 5.2.0 | — |
| redhat jboss_enterprise_web_server | 2.0.1 | — |
| redhat storage | 2.1 | — |
| fedoraproject fedora | 19, 20 | — |
| opensuse opensuse | 13.1, 13.2 | — |
| redhat enterprise_linux | 4, 5, 6.0 | — |
| filezilla-project filezilla_server | v < 0.9.45 | 0.9.45 |
| siemens application_processing_engine_firmware | v < 2.0.2 | 2.0.2 |
| siemens cp1543-1_firmware | v < 1.1.25 | 1.1.25 |
| siemens s7-1500_firmware | v < 1.6 | 1.6 |
| siemens rox_firmware | v < 1.16.1 | 1.16.1 |
| mariadb mariadb | 10.0.0 ≤ v < 10.0.13 | 10.0.13 |
| python python | 2.7.0 ≤ v < 2.7.8, 3.4.0 ≤ v < 3.4.2 | 2.7.8, 3.4.2 |
| nodejs node.js | v < 0.10.29 | 0.10.29 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.