CVE-2014-0221

Advisory lineage Upstream: 0 Downstream: 14
Modified
Published: 05 Jun 2014, 21:00
Last modified:06 Aug 2024, 09:05

Vulnerability Summary

Overall Risk (default)
medium
34/100
CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
82.1% CRITICAL
82% probability -0.92%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Jun 2014, 21:00
Published
Vulnerability first disclosed
06 Aug 2024, 09:05
Last Modified
Vulnerability information updated

Description

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

CVSS Metrics

  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 82.10%• Percentile: 99%

Affected Systems

  • fedoraproject•fedora

    19 | 20

  • mariadb•mariadb

    ≥ 10.0.0, < 10.0.13

  • Unknown•OpenSSL

    ≥ 0.9.8, < 0.9.8za | ≥ 1.0.0, < 1.0.0m | ≥ 1.0.1, < 1.0.1h

  • opensuse•leap

    42.1

  • opensuse•opensuse

    13.2

  • redhat•enterprise_linux

    5 | 6.0

  • redhat•storage

    2.1

  • suse•linux_enterprise_desktop

    12

  • suse•linux_enterprise_server

    12

  • suse•linux_enterprise_software_development_kit

    12

  • suse•linux_enterprise_workstation_extension

    12

References (127)