CVE-2014-0224: fedoraproject fedora Inadequate Encryption Strength

Modified

AliasesRHSA-2014:0624RHSA-2014:0626RHSA-2014:0627+3 more

Published 05-06-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-0224 is a high (CVSS 7.4) Inadequate Encryption Strength vulnerability in fedoraproject fedora. EPSS estimates a 95.33% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (Metasploit, 05-06-2014)

Source freshness unavailable

How is this decided?

CVSS score

7.4/10

010

High · v3.1 (NVD)

EPSS score

95.33%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference, metasploit

Advisory lineage

Upstream 0 · Downstream 16 · Related 8

DLA-0003-1 DLA-0008-1 DSA-2950-1 MGASA-2014-0255 OPENSUSE-SU-2024:10020-1 OPENSUSE-SU-2024:11127-1+10 more

Timeline

05-06-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.17.4v2.05.8

EPSS trend

Probability

95.33%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 95.33% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (imperialviolet.org)
Maturity: unknown
MetasploitremoteUnverified
OpenSSL Server-Side ChangeCipherSpec Injection Scanner
auxiliary/scanner/ssl/openssl_ccs
Maturity: poc

Weaknesses

CWE · root cause

CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat14 products

enterprise_linuxEOL4 | 5 | 6.0
jboss_enterprise_application_platform5.2.0 | 6.2.3
jboss_enterprise_web_platform5.2.0
jboss_enterprise_web_server2.0.1
storage2.1

Show all 14

Siemens4 products

application_processing_engine_firmware< 2.0.2
cp1543-1_firmware< 1.1.25
rox_firmware< 1.16.1
s7-1500_firmware< 1.6

Ubuntu2 products

openssl< 1.0.1f-1ubuntu2.2
openssl098< 0.9.8o-7ubuntu3.2.14.04.1

Debian1 product

openssl< 1.0.1h-1

Fedoraproject1 product

fedoraEOL19 | 20

Filezilla-project1 product

filezilla_server< 0.9.45

Mariadb1 product

mariadb≥ 10.0.0, < 10.0.13

Nodejs1 product

node.js< 0.10.29

Openssl1 product

openssl< 0.9.8za | ≥ 1.0.0, < 1.0.0m | ≥ 1.0.1, < 1.0.1h

Opensuse1 product

opensuseEOL13.1 | 13.2

Python1 product

python≥ 2.7.0, < 2.7.8 | ≥ 3.4.0, < 3.4.2

11 vendors · 28 products

References

322 links

secunia.com/advisories/59342Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59669Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59525Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=140604261522465&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
secunia.com/advisories/59004Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59530Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21675626X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59824Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59282Third Party AdvisoryX Refsource SECUNIA
www.novell.com/support/kb/doc.php?id=7015300X Refsource CONFIRMThird Party Advisory

Show all 100 references

secunia.com/advisories/59215Third Party AdvisoryX Refsource SECUNIA
bugzilla.redhat.com/show_bug.cgi?id=1103586X Refsource CONFIRMIssue TrackingREPORT
secunia.com/advisories/59990Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59264Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59454Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/58492Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59186Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59188Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59126Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=140672208601650&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
marc.info?l=bugtraq&m=140784085708882&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
www.novell.com/support/kb/doc.php?id=7015264X Refsource CONFIRMThird Party Advisory
support.f5.com/kb/en-us/solutions/public/15000/300/sol15325.htmlX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59306Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2014-0627.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0X Refsource CONFIRMThird Party Advisory
marc.info?l=bugtraq&m=140544599631400&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
rhn.redhat.com/errata/RHSA-2014-0626.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/59190Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/58639Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21678289X Refsource CONFIRMThird Party Advisory
www.ibm.com/support/docview.wss?uid=swg21676877X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59446Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59529Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59445Third Party AdvisoryX Refsource SECUNIA
www.vmware.com/security/advisories/VMSA-2014-0012.htmlX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59589Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59894Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59325Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59354Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg24037729X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21677131X Refsource CONFIRMThird Party Advisory
marc.info?l=bugtraq&m=140266410314613&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
secunia.com/advisories/61254Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21678233X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59447Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id/1031594VDB EntryX Refsource SECTRACKThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21676655X Refsource CONFIRMThird Party Advisory
www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=6061&myns=phmc&mync=EX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59223Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/58743Third Party AdvisoryX Refsource SECUNIA
www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlX Refsource CONFIRMPatch
secunia.com/advisories/58719Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59449Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59132Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=142350350616251&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=isg400001843X Refsource CONFIRMThird Party Advisory
marc.info?l=bugtraq&m=140870499402361&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
marc.info?l=bugtraq&m=140386311427810&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
secunia.com/advisories/59442Third Party AdvisoryX Refsource SECUNIA
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946X Refsource CONFIRMThird Party Advisory
marc.info?l=bugtraq&m=140317760000786&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
marc.info?l=bugtraq&m=142805027510172&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21676879X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg24037761X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21677828X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59441Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=140621259019789&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdfX Refsource CONFIRMThird Party Advisory
marc.info?l=bugtraq&m=140852757108392&w=2Vendor AdvisoryX Refsource HPThird Party Advisory
filezilla-project.org/versions.php?type=serverX Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21676786X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/60567Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59189Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59368Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2014:106Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
secunia.com/advisories/59142Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21676478X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21676845X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/58742Third Party AdvisoryX Refsource SECUNIA
www.ibm.com/support/docview.wss?uid=ssg1S1004670X Refsource CONFIRMThird Party Advisory
rhn.redhat.com/errata/RHSA-2014-0624.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/59602Third Party AdvisoryX Refsource SECUNIA
www.kerio.com/support/kerio-control/release-historyX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59300Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/58930Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21677080X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/61815Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/58667Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-201407-05.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21677390X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59191Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59284Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59444Third Party AdvisoryX Refsource SECUNIA
www.imperialviolet.org/2014/06/05/earlyccs.htmlX Refsource MISCExploit
www.ibm.com/support/docview.wss?uid=swg24037783X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59365Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21677695X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59305Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21676529X Refsource CONFIRMThird Party Advisory

Showing 100 of 322.