CVE-2014-3470

Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 05 Jun 2014, 21:00
Last modified:06 Aug 2024, 10:43

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
91.4% CRITICAL
91% probability +0.13%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Jun 2014, 21:00
Published
Vulnerability first disclosed
06 Aug 2024, 10:43
Last Modified
Vulnerability information updated

Description

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

CVSS Metrics

  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 91.40%• Percentile: 100%

Techniques & Countermeasures

  • CWE-476•NULL Pointer Dereference

    The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

  • fedoraproject•fedora

    19 | 20

  • mariadb•mariadb

    ≥ 10.0.0, < 10.0.13

  • Unknown•OpenSSL

    < 0.9.8za | ≥ 1.0.0, < 1.0.0m | ≥ 1.0.1, < 1.0.1h

  • opensuse•leap

    42.1

  • opensuse•opensuse

    13.2

  • redhat•enterprise_linux

    5 | 6.0

  • redhat•storage

    2.1

  • suse•linux_enterprise_desktop

    12

  • suse•linux_enterprise_server

    12

  • suse•linux_enterprise_software_development_kit

    12

  • suse•linux_enterprise_workstation_extension

    12

References (150)