CVE-2014-3566: apple mac_os_x Cryptographic Issues
Modified
AliasesMGASA-2014-0489SUSE-FU-2022:0039-1SUSE-RU-2015:1175-1RHBA-2014:1857RHSA-2015:1545RHSA-2015:1546UBUNTU-CVE-2014-3566DEBIAN-CVE-2014-3566DLA-282-1DSA-3489-1openSUSE-SU-2024:10479-1openSUSE-SU-2024:11388-1
Published 15-10-2014Last modified 28-05-2026
Some data may be incomplete
- 1 reference with an unsupported link type was hidden.
Vulnerability summary
CVE-2014-3566 is a medium (CVSS 4.3) Cryptographic Issues vulnerability in apple mac_os_x. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.
Priority
Prioritiseweaponized exploit
Weaponized exploit (Metasploit, 14-10-2014)
Source freshness unavailable
How is this decided?CVSS score
4.3/10
010
Medium · v2.0 (NVD)EPSS score
100.00%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1metasploit
Advisory lineage
Upstream 0 · Downstream 33 · Related 12DLA-157-1DLA-400-1DSA-3092-1DSA-3144-1DSA-3147-1DSA-3253-1MGASA-2014-0416OPENSUSE-SU-2024:10275-1OPENSUSE-SU-2024:10311-1OPENSUSE-SU-2024:10534-1RHBA-2015:0364RHSA-2014:1876RHSA-2014:1877RHSA-2014:1880RHSA-2014:1881RHSA-2014:1882RHSA-2015:0067RHSA-2015:0068RHSA-2015:0069RHSA-2015:0079RHSA-2015:0080RHSA-2015:0085RHSA-2015:0086RHSA-2015:0264SUSE-SU-2015:0503-1SUSE-SU-2016:1457-1SUSE-SU-2016:1459-1SUSE-SU-2016:2285-1SUSE-SU-2016:2329-1SUSE-SU-2016:2396-1SUSE-SU-403SUSE-SU-403_FORBIDDEN-1USN-2487-1
Timeline
- 15-10-2014PublishedVulnerability first disclosed.
- 28-05-2026Last modifiedVulnerability information updated.
Description
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
CVSS metrics
5 scores · 4 sources · 2 versionsLow 3.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:NSourcesAll 4 agree
- NVDNIST3.4LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated3.4LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.4LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
100.00%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 100.00% on 05-10-2026
05-10-202604-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundSSL/TLS Version Detection
auxiliary/scanner/ssl/ssl_version
Maturity: poc
Weaknesses
CWE · root cause- CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
- CWE-329Generation of Predictable IV with CBC ModeThe product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
Affected systems
Version check
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat45 products
- enterprise_linuxEOL5
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_desktop_supplementary5.0 | 6.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_supplementary5.0 | 6.0 | 7.0
Suse40 products
- gnome-packagekit&distro=SUSE Linux Enterprise Desktop 12< 3.10.1-8.13
- gnome-packagekit&distro=SUSE Linux Enterprise Server 12< 3.10.1-8.13
- gnome-packagekit&distro=SUSE Linux Enterprise Server for SAP Applications 12< 3.10.1-8.13
- libreoffice&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 7.2.3.2-48.11.4
- libreoffice&distro=SUSE Linux Enterprise Workstation Extension 12 SP5< 7.2.3.2-48.11.4
Debian12 products
- epiphany-browserAll versions (No fix recorded)
- erlang< 1:17.3-dfsg-3
- gnutls28< 3.3.8-5
- haskell-tls< 1.2.9-2
- lighttpd< 1.4.28-2+squeeze1.7 | < 1.4.31-4+deb7u4 | < 1.4.35-4
Ubuntu4 products
- openjdk-6< 6b34-1.13.6-1ubuntu0.14.04.1
- openjdk-7< 7u75-2.5.4-1~trusty1
- openssl< 1.0.1f-1ubuntu2.7
- poundAll versions (No fix recorded)
Mageia3 products
- ruby-httpclient< 2.4.0-1.mga3
- ruby-httpclient< 2.4.0-1.mga4
- mageiaEOL3.0 | 4.0
Novell3 products
- suse_linux_enterprise_desktop9.0 | 10.0 | 11.0 | 12.0
- suse_linux_enterprise_serverEOL11.0:sp3 | 12.0
- suse_linux_enterprise_software_development_kit11.0:sp3 | 12.0
Opensuse3 products
- opensuseEOL12.3 | 13.1
- fossil&distro=openSUSE Tumbleweed< 1.35-1.3
- slrn&distro=openSUSE Tumbleweed< 1.0.3-3.13
Ibm2 products
Apple1 product
- mac_os_x≤ 10.10.1
Fedoraproject1 product
- fedoraEOL19 | 20 | 21
Netbsd1 product
- netbsdEOL5.1 | 5.1.1 | 5.1.2 | 5.1.3 | 5.1.4 | 5.2 | 5.2.1 | 5.2.2 | 6.0 | 6.0:beta | 6.0.1 | 6.0.2 | 6.0.3 | 6.0.4 | 6.0.5 | 6.0.6 | 6.1 | 6.1.1 | 6.1.2 | 6.1.3 | 6.1.4 | 6.1.5
Openssl1 product
- opensslEOL0.9.8 | 0.9.8a | 0.9.8b | 0.9.8c | 0.9.8d | 0.9.8e | 0.9.8f | 0.9.8g | 0.9.8h | 0.9.8i | 0.9.8j | 0.9.8k | 0.9.8l | 0.9.8m | 0.9.8m:beta1 | 0.9.8n | 0.9.8o | 0.9.8p | 0.9.8q | 0.9.8r | 0.9.8s | 0.9.8t | 0.9.8u | 0.9.8v | 0.9.8w | 0.9.8x | 0.9.8y | 0.9.8z | 0.9.8za | 0.9.8zb | 1.0.0 | 1.0.0:beta1 | 1.0.0:beta2 | 1.0.0:beta3 | 1.0.0:beta4 | 1.0.0:beta5 | 1.0.0a | 1.0.0b | 1.0.0c | 1.0.0d | 1.0.0e | 1.0.0f | 1.0.0g | 1.0.0h | 1.0.0i | 1.0.0j | 1.0.0k | 1.0.0l | 1.0.0m | 1.0.0n | 1.0.1 | 1.0.1:beta1 | 1.0.1:beta2 | 1.0.1:beta3 | 1.0.1a | 1.0.1b | 1.0.1c | 1.0.1d | 1.0.1e | 1.0.1f | 1.0.1g | 1.0.1h | 1.0.1i
Oracle1 product
- database11.2.0.4 | 12.1.0.2
13 vendors · 117 products
References
336 links- aix.software.ibm.com/aix/efixes/security/openssl_advisory11.ascX Refsource CONFIRMThird Party Advisory
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04819635X Refsource CONFIRMThird Party Advisory
Show all 100 references
- lists.opensuse.org/opensuse-security-announce/2014-10/msg00008.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlX Refsource CONFIRMThird Party Advisory
- marc.info?l=openssl-dev&m=141333049205629&w=2Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
- lists.opensuse.org/opensuse-security-announce/2015-03/msg00018.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- archives.neohapsis.com/archives/bugtraq/2014-10/0103.htmlVendor AdvisoryX Refsource APPLEThird Party Advisory
- www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0X Refsource CONFIRMThird Party Advisory
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667X Refsource CONFIRMThird Party Advisory
- h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034X Refsource CONFIRMThird Party Advisory
- www.securityfocus.com/archive/1/533724/100/0/threadedVendor AdvisoryX Refsource APPLEThird Party AdvisoryVDB Entry
- www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlX Refsource CONFIRMPatchThird Party Advisory
- googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.htmlX Refsource MISCThird Party Advisory
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946X Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2014-12/msg00002.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566X Refsource MISCThird Party Advisory
- www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlX Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-3566.htmlX Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdfX Refsource CONFIRMThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlX Refsource CONFIRMThird Party Advisory
- lists.apple.com/archives/security-announce/2015/Sep/msg00002.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2014-11/msg00001.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- devcentral.f5.com/articles/cve-2014-3566-removing-sslv3-from-big-ipX Refsource CONFIRMThird Party Advisory
Showing 100 of 336.