CVE-2014-3566

Advisory lineage Upstream: 0 Downstream: 45
Modified
Published: 15 Oct 2014, 00:00
Last modified:28 May 2026, 17:35

Vulnerability Summary

Overall Risk (default)
medium
46/100
CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
93.54% CRITICAL
94% probability -0.19%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

15 Oct 2014, 00:00
Published
Vulnerability first disclosed
28 May 2026, 17:35
Last Modified
Vulnerability information updated

Description

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

CVSS Metrics

  • v3.1•LOW•Score: 3.4CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 93.54%• Percentile: 100%

Techniques & Countermeasures

  • CWE-310•Cryptographic Issues

    Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

  • CWE-329•Generation of Predictable IV with CBC Mode

    The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.

Affected Systems

  • apple•mac_os_x

    ≤ 10.10.1

  • debian•debian_linux

    7.0 | 8.0

  • fedoraproject•fedora

    19 | 20 | 21

  • ibm•aix

    5.3 | 6.1 | 7.1

  • ibm•vios

    2.2.0.10 | 2.2.0.11 | 2.2.0.12 | 2.2.0.13 | 2.2.1.0 | 2.2.1.1 | 2.2.1.3 | 2.2.1.4 | 2.2.1.5 | 2.2.1.6 | 2.2.1.7 | 2.2.1.8 | 2.2.1.9 | 2.2.2.0 | 2.2.2.1 | 2.2.2.2 | 2.2.2.3 | 2.2.2.4 | 2.2.2.5 | 2.2.3.0 | 2.2.3.1 | 2.2.3.2 | 2.2.3.3 | 2.2.3.4

  • mageia•mageia

    3.0 | 4.0

  • netbsd•netbsd

    5.1 | 5.1.1 | 5.1.2 | 5.1.3 | 5.1.4 | 5.2 | 5.2.1 | 5.2.2 | 6.0 | 6.0:beta | 6.0.1 | 6.0.2 | 6.0.3 | 6.0.4 | 6.0.5 | 6.0.6 | 6.1 | 6.1.1 | 6.1.2 | 6.1.3 | 6.1.4 | 6.1.5

  • novell•suse_linux_enterprise_desktop

    9.0 | 10.0 | 11.0 | 12.0

  • novell•suse_linux_enterprise_server

    11.0:sp3 | 12.0

  • novell•suse_linux_enterprise_software_development_kit

    11.0:sp3 | 12.0

  • Unknown•OpenSSL

    0.9.8 | 0.9.8a | 0.9.8b | 0.9.8c | 0.9.8d | 0.9.8e | 0.9.8f | 0.9.8g | 0.9.8h | 0.9.8i | 0.9.8j | 0.9.8k | 0.9.8l | 0.9.8m | 0.9.8m:beta1 | 0.9.8n | 0.9.8o | 0.9.8p | 0.9.8q | 0.9.8r | 0.9.8s | 0.9.8t | 0.9.8u | 0.9.8v | 0.9.8w | 0.9.8x | 0.9.8y | 0.9.8z | 0.9.8za | 0.9.8zb | 1.0.0 | 1.0.0:beta1 | 1.0.0:beta2 | 1.0.0:beta3 | 1.0.0:beta4 | 1.0.0:beta5 | 1.0.0a | 1.0.0b | 1.0.0c | 1.0.0d | 1.0.0e | 1.0.0f | 1.0.0g | 1.0.0h | 1.0.0i | 1.0.0j | 1.0.0k | 1.0.0l | 1.0.0m | 1.0.0n | 1.0.1 | 1.0.1:beta1 | 1.0.1:beta2 | 1.0.1:beta3 | 1.0.1a | 1.0.1b | 1.0.1c | 1.0.1d | 1.0.1e | 1.0.1f | 1.0.1g | 1.0.1h | 1.0.1i

  • opensuse•opensuse

    12.3 | 13.1

  • oracle•database

    11.2.0.4 | 12.1.0.2

  • redhat•enterprise_linux

    5

  • redhat•enterprise_linux_desktop

    6.0 | 7.0

  • redhat•enterprise_linux_desktop_supplementary

    5.0 | 6.0

  • redhat•enterprise_linux_server

    6.0 | 7.0

  • redhat•enterprise_linux_server_supplementary

    5.0 | 6.0 | 7.0

  • redhat•enterprise_linux_workstation

    6.0 | 7.0

  • redhat•enterprise_linux_workstation_supplementary

    6.0 | 7.0

References (244)