CVE-2014-0160: OpenSSL Information Disclosure Vulnerability
Vulnerability summary
CVE-2014-0160 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in OpenSSL. It is known to be exploited: CISA lists it, first on 04-05-2022. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 9 public exploits are recorded.
Listed as exploited by CISA (04-05-2022)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Duplicates 1 · Related 4Timeline
- 07-04-2014PublishedVulnerability first disclosed.
- 04-05-2022Added to CISA KEVExploitedOpenSSL Information Disclosure Vulnerability
- 25-05-2022CISA remediation dueDeadline passedApply updates per vendor instructions.
- 22-10-2025Last modifiedVulnerability information updated.
Description
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
CVSS metrics
4 scores · 3 sources · 2 versions- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
100.00%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 100.00% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 04-05-2022
- Federal due date
- 25-05-2022
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2014-0160
Public exploits
9 found10473815
Maturity: poc
Exploit Reference (sku11army.blogspot.com)
Maturity: unknown
Exploit Reference (yunus-shn.medium.com)
Maturity: unknown
Show all 9 exploits
OpenSSL 1.0.1f TLS Heartbeat Extension - 'Heartbleed' Memory Disclosure (Multiple SSL/TLS Versions)
Maturity: weaponized
OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (1)
Maturity: weaponized
OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support)
Maturity: weaponized
OpenSSL TLS Heartbeat Extension - 'Heartbleed' Memory Disclosure
Maturity: weaponized
OpenSSL Heartbeat (Heartbleed) Information Leak
auxiliary/scanner/ssl/openssl_heartbleed
Maturity: poc
OpenSSL Heartbeat (Heartbleed) Client Memory Exposure
auxiliary/server/openssl_heartbeat_client_memory
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat15 products
- enterprise_linux_desktop6.0
- enterprise_linux_server6.0
- enterprise_linux_server_aus6.5
- enterprise_linux_server_eus6.5
- enterprise_linux_server_tus6.5
Siemens6 products
- application_processing_engine_firmware2.0
- cp_1543-1_firmware1.1
- elan-8.2< 8.3.3
- simatic_s7-15001.5
- simatic_s7-1500t_firmware1.5
Debian2 products
- openssl< 1.0.1e-2+deb7u5 | < 1.0.1g-1
- debian_linuxEOL6.0 | 7.0 | 8.0
Intellian2 products
- v100_firmware1.20 | 1.21 | 1.24
- v60_firmware1.15 | 1.25
Mageia2 products
- tor< 0.2.4.22-1.mga3
- tor< 0.2.4.22-1.mga4
Mitel2 products
Broadcom1 product
- symantec_messaging_gateway10.6.0 | 10.6.1
Canonical1 product
- ubuntu_linuxEOL12.04 | 12.10 | 13.10
Fedoraproject1 product
- fedoraEOL19 | 20
Filezilla-project1 product
- filezilla_server< 0.9.44
Openssl1 product
- openssl≥ 1.0.1, < 1.0.1g
Opensuse1 product
- opensuseEOL12.3 | 13.1
Ricon1 product
- s9922l_firmware16.10.3\(3794\)
Splunk1 product
- splunk≥ 6.0.0, < 6.0.3
14 vendors · 37 products
References
150 links- support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217Third Party Advisory
- www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/Third Party Advisory
Show all 100 references
- www.splunk.com/view/SP-CAAAMB3Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.htmlVendor AdvisoryMailing ListThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=isg400001843Third Party Advisory
- filezilla-project.org/versions.php?type=serverRelease Notes
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleedVendor AdvisoryThird Party Advisory
- advisories.mageia.org/MGASA-2014-0165.htmlThird Party Advisory
- www.blackberry.com/btsc/KB35882Broken Link
- lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.htmlVendor AdvisoryBroken LinkThird Party Advisory
- www.securityfocus.com/archive/1/534161/100/0/threadedMailing ListBroken LinkNot ApplicableThird Party AdvisoryVDB Entry
- lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.htmlVendor AdvisoryBroken LinkThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.htmlVendor AdvisoryMailing ListThird Party Advisory
- www-01.ibm.com/support/docview.wss?uid=isg400001841Third Party Advisory
- code.google.com/p/mod-spdy/issues/detail?id=85Issue Tracking
- heartbleed.comThird Party Advisory
- cogentdatahub.com/ReleaseNotes.htmlRelease Notes
- lists.balabit.hu/pipermail/syslog-ng-announce/2014-April/000184.htmlMailing ListThird Party Advisory
- blog.torproject.org/blog/openssl-bug-cve-2014-0160Issue Tracking
- www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.htmlPatchThird Party Advisory
- support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.htmlThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2014-04/msg00005.htmlVendor AdvisoryMailing ListThird Party Advisory
- www.symantec.com/security_response/…Third Party Advisory
- www-01.ibm.com/support/docview.wss?uid=ssg1S1004661Third Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2015:062Vendor AdvisoryBroken LinkThird Party Advisory
Showing 100 of 150.