CVE-2014-3509: openssl

Modified

AliasesUBUNTU-CVE-2014-3509DEBIAN-CVE-2014-3509

Published 13-08-2014Last modified 06-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2014-3509 is a medium (CVSS 6.8) vulnerability in openssl. EPSS estimates a 12.91% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

12.91%

0%100%

Medium · -0.51 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 3

DSA-2998-1 MGASA-2014-0325 OPENSUSE-SU-2024:10309-1 OPENSUSE-SU-2024:11127-1 RHSA-2014:1052 RHSA-2014:1054+2 more

Timeline

13-08-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

12.91%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

Decrease -0.51 pp

From 13.42% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

openssl< 1.0.1i-1

Openssl1 product

opensslEOL1.0.0 | 1.0.0:beta1 | 1.0.0:beta2 | 1.0.0:beta3 | 1.0.0:beta4 | 1.0.0:beta5 | 1.0.0a | 1.0.0b | 1.0.0c | 1.0.0d | 1.0.0e | 1.0.0f | 1.0.0g | 1.0.0h | 1.0.0i | 1.0.0j | 1.0.0k | 1.0.0l | 1.0.0m | 1.0.1 | 1.0.1:beta1 | 1.0.1:beta2 | 1.0.1:beta3 | 1.0.1a | 1.0.1b | 1.0.1c | 1.0.1d | 1.0.1e | 1.0.1f | 1.0.1g | 1.0.1h

Ubuntu1 product

openssl< 1.0.1f-1ubuntu2.5

3 vendors · 3 products

References

55 links

lists.opensuse.org/opensuse-updates/2014-08/msg00036.htmlVendor AdvisoryX Refsource SUSE
bugzilla.redhat.com/show_bug.cgi?id=1127498X Refsource CONFIRM
linux.oracle.com/errata/ELSA-2014-1052.htmlX Refsource CONFIRM
secunia.com/advisories/60221Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21682293X Refsource CONFIRM
secunia.com/advisories/61184Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=142660345230545&w=2Vendor AdvisoryX Refsource HP
secunia.com/advisories/60022Third Party AdvisoryX Refsource SECUNIA
www.openssl.org/news/secadv_20140806.txtX Refsource CONFIRMVendor AdvisoryREPORT
secunia.com/advisories/61017Third Party AdvisoryX Refsource SECUNIA

Show all 55 references

rhn.redhat.com/errata/RHSA-2015-0197.htmlVendor AdvisoryX Refsource REDHAT
marc.info?l=bugtraq&m=142350350616251&w=2Vendor AdvisoryX Refsource HP
www-01.ibm.com/support/docview.wss?uid=swg21683389X Refsource CONFIRM
marc.info?l=bugtraq&m=142791032306609&w=2Vendor AdvisoryX Refsource HP
www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htmX Refsource CONFIRM
www.securityfocus.com/bid/69084VDB EntryX Refsource BID
git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=fb0bc2b273bcc2d5401dd883fe869af4fc74bb21X Refsource CONFIRM
security.gentoo.org/glsa/glsa-201412-39.xmlVendor AdvisoryX Refsource GENTOO
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888X Refsource CONFIRM
marc.info?l=bugtraq&m=142495837901899&w=2Vendor AdvisoryX Refsource HP
secunia.com/advisories/60803Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59700Third Party AdvisoryX Refsource SECUNIA
lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.htmlVendor AdvisoryX Refsource FEDORA
www.securitytracker.com/id/1030693VDB EntryX Refsource SECTRACK
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380X Refsource CONFIRM
secunia.com/advisories/60917Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/60493Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59710Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/60921Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=nas8N1020240X Refsource CONFIRM
secunia.com/advisories/61100Third Party AdvisoryX Refsource SECUNIA
www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.ascVendor AdvisoryX Refsource FREEBSD
secunia.com/advisories/61775Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2014/dsa-2998Vendor AdvisoryX Refsource DEBIAN
marc.info?l=bugtraq&m=143290437727362&w=2Vendor AdvisoryX Refsource HP
lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.htmlVendor AdvisoryX Refsource FEDORA
exchange.xforce.ibmcloud.com/vulnerabilities/95159VDB EntryX Refsource XF
secunia.com/advisories/61959Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59756Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=142624590206005&w=2Vendor AdvisoryX Refsource HP
marc.info?l=bugtraq&m=143290522027658&w=2Vendor AdvisoryX Refsource HP
aix.software.ibm.com/aix/efixes/security/openssl_advisory10.ascX Refsource CONFIRM
secunia.com/advisories/58962Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/60938Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/60684Third Party AdvisoryX Refsource SECUNIA
support.citrix.com/article/CTX216642X Refsource CONFIRM
lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.htmlMailing ListX Refsource MLIST
techzone.ergon.ch/CVE-2014-3511X Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDVSA-2014:158Vendor AdvisoryX Refsource MANDRIVA
www-01.ibm.com/support/docview.wss?uid=swg21686997X Refsource CONFIRM
secunia.com/advisories/61139Third Party AdvisoryX Refsource SECUNIA
ubuntu.com/security/CVE-2014-3509REPORT
ubuntu.com/security/notices/USN-2308-1Advisory
www.cve.org/CVERecord?id=CVE-2014-3509REPORT
security-tracker.debian.org/tracker/CVE-2014-3509Advisory