CVE-2014-3569: openssl

Modified

AliasesUBUNTU-CVE-2014-3569DEBIAN-CVE-2014-3569

Published 24-12-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-3569 is a medium (CVSS 5.0) vulnerability in openssl. EPSS estimates a 19.52% chance of exploitation in the next 30 days, higher than 97.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

19.52%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Duplicates 1 · Related 1

DLA-81-1 DSA-3125-1 MGASA-2015-0022 OPENSUSE-SU-2024:11127-1 CVE-2015-3569

Timeline

24-12-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

19.52%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 19.52% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

openssl< 1.0.1k-1

Openssl1 product

openssl1.0.1j

Ubuntu1 product

openssl< 1.0.1f-1ubuntu2.8

3 vendors · 3 products

References

42 links

www.securityfocus.com/bid/71934VDB EntryX Refsource BID
marc.info?l=bugtraq&m=142895206924048&w=2Vendor AdvisoryX Refsource HP
www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlX Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2015-01/msg00021.htmlVendor AdvisoryX Refsource SUSE
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150310-sslVendor AdvisoryX Refsource CISCO
people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-3569.htmlX Refsource CONFIRM
marc.info?l=bugtraq&m=144050155601375&w=2Vendor AdvisoryX Refsource HP
support.apple.com/HT204659X Refsource CONFIRM
www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlX Refsource CONFIRM
security-tracker.debian.org/tracker/CVE-2014-3569X Refsource CONFIRMAdvisory

Show all 42 references

www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlX Refsource CONFIRM
marc.info?l=bugtraq&m=143748090628601&w=2Vendor AdvisoryX Refsource HP
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888X Refsource CONFIRM
www.securitytracker.com/id/1033378VDB EntryX Refsource SECTRACK
marc.info?l=bugtraq&m=142721102728110&w=2Vendor AdvisoryX Refsource HP
lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlVendor AdvisoryX Refsource SUSE
www.openssl.org/news/secadv_20150108.txtX Refsource CONFIRMREPORT
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380X Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDVSA-2015:019Vendor AdvisoryX Refsource MANDRIVA
www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlX Refsource CONFIRM
kb.juniper.net/InfoCenter/index?page=content&id=JSA10679X Refsource CONFIRM
www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlX Refsource CONFIRM
git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=b82924741b4bd590da890619be671f4635e46c2bX Refsource CONFIRM
marc.info?l=bugtraq&m=142496289803847&w=2Vendor AdvisoryX Refsource HP
lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlVendor AdvisoryX Refsource APPLE
kc.mcafee.com/corporate/index?page=content&id=SB10108X Refsource CONFIRM
git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=6ce9687b5aba5391fc0de50e18779eb676d0e04dX Refsource CONFIRM
kc.mcafee.com/corporate/index?page=content&id=SB10102X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.htmlVendor AdvisoryX Refsource SUSE
marc.info?l=bugtraq&m=144050297101809&w=2Vendor AdvisoryX Refsource HP
www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlX Refsource CONFIRM
marc.info?l=bugtraq&m=144050205101530&w=2Vendor AdvisoryX Refsource HP
marc.info?l=bugtraq&m=142496179803395&w=2Vendor AdvisoryX Refsource HP
www.mandriva.com/security/advisories?name=MDVSA-2015:062Vendor AdvisoryX Refsource MANDRIVA
support.citrix.com/article/CTX216642X Refsource CONFIRM
marc.info?l=bugtraq&m=144050254401665&w=2Vendor AdvisoryX Refsource HP
rt.openssl.org/Ticket/Display.html?id=3571&user=guest&pass=guestX Refsource CONFIRM
bto.bluecoat.com/security-advisory/sa88X Refsource CONFIRM
git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=392fa7a952e97d82eac6958c81ed1e256e6b8ca5X Refsource CONFIRM
www.debian.org/security/2015/dsa-3125Vendor AdvisoryX Refsource DEBIAN
ubuntu.com/security/CVE-2014-3569REPORT
www.cve.org/CVERecord?id=CVE-2014-3569REPORT