CVE-2014-5139: openssl

Modified

AliasesUBUNTU-CVE-2014-5139DEBIAN-CVE-2014-5139

Published 13-08-2014Last modified 06-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2014-5139 is a medium (CVSS 4.3) vulnerability in openssl. EPSS estimates a 16.29% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

16.29%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Duplicates 1 · Related 3

DSA-2998-1 MGASA-2014-0325 OPENSUSE-SU-2024:10309-1 OPENSUSE-SU-2024:11127-1 USN-2308-1 CVE-2014-2970

Timeline

13-08-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

16.29%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 16.29% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

openssl< 1.0.1i-1

Openssl1 product

opensslEOL1.0.1 | 1.0.1:beta1 | 1.0.1:beta2 | 1.0.1:beta3 | 1.0.1a | 1.0.1b | 1.0.1c | 1.0.1d | 1.0.1e | 1.0.1f | 1.0.1g | 1.0.1h

Ubuntu1 product

openssl< 1.0.1f-1ubuntu2.5

3 vendors · 3 products

References

50 links

lists.opensuse.org/opensuse-updates/2014-08/msg00036.htmlVendor AdvisoryX Refsource SUSE
support.f5.com/kb/en-us/solutions/public/15000/500/sol15567.htmlX Refsource CONFIRM
secunia.com/advisories/60221Third Party AdvisoryX Refsource SECUNIA
www-01.ibm.com/support/docview.wss?uid=swg21682293X Refsource CONFIRM
secunia.com/advisories/61184Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=142660345230545&w=2Vendor AdvisoryX Refsource HP
secunia.com/advisories/60022Third Party AdvisoryX Refsource SECUNIA
www.openssl.org/news/secadv_20140806.txtX Refsource CONFIRMVendor AdvisoryREPORT
secunia.com/advisories/61017Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=142350350616251&w=2Vendor AdvisoryX Refsource HP

Show all 50 references

www-01.ibm.com/support/docview.wss?uid=swg21683389X Refsource CONFIRM
marc.info?l=bugtraq&m=142791032306609&w=2Vendor AdvisoryX Refsource HP
marc.info?l=bugtraq&m=142624619906067&w=2Vendor AdvisoryX Refsource HP
www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htmX Refsource CONFIRM
security.gentoo.org/glsa/glsa-201412-39.xmlVendor AdvisoryX Refsource GENTOO
www.securityfocus.com/bid/69077VDB EntryX Refsource BID
marc.info?l=bugtraq&m=142495837901899&w=2Vendor AdvisoryX Refsource HP
secunia.com/advisories/60803Third Party AdvisoryX Refsource SECUNIA
git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=80bd7b41b30af6ee96f519e629463583318de3b0X Refsource CONFIRM
secunia.com/advisories/59700Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id/1030693VDB EntryX Refsource SECTRACK
secunia.com/advisories/60917Third Party AdvisoryX Refsource SECUNIA
www.tenable.com/security/tns-2014-06X Refsource CONFIRM
secunia.com/advisories/60493Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59710Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/60921Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/60810Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=142624679706236&w=2Vendor AdvisoryX Refsource HP
www-01.ibm.com/support/docview.wss?uid=nas8N1020240X Refsource CONFIRM
secunia.com/advisories/61100Third Party AdvisoryX Refsource SECUNIA
www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.ascVendor AdvisoryX Refsource FREEBSD
secunia.com/advisories/61775Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2014/dsa-2998Vendor AdvisoryX Refsource DEBIAN
marc.info?l=bugtraq&m=143290437727362&w=2Vendor AdvisoryX Refsource HP
marc.info?l=bugtraq&m=142624719706349&w=2Vendor AdvisoryX Refsource HP
secunia.com/advisories/61959Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59756Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=142624590206005&w=2Vendor AdvisoryX Refsource HP
marc.info?l=bugtraq&m=143290522027658&w=2Vendor AdvisoryX Refsource HP
aix.software.ibm.com/aix/efixes/security/openssl_advisory10.ascX Refsource CONFIRM
secunia.com/advisories/61392Third Party AdvisoryX Refsource SECUNIA
lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.htmlMailing ListX Refsource MLIST
secunia.com/advisories/61171Third Party AdvisoryX Refsource SECUNIA
git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=83764a989dcc87fbea337da5f8f86806fe767b7eX Refsource CONFIRM
marc.info?l=bugtraq&m=142624619906067Vendor AdvisoryX Refsource HP
www-01.ibm.com/support/docview.wss?uid=swg21686997X Refsource CONFIRM
ubuntu.com/security/CVE-2014-5139REPORT
ubuntu.com/security/notices/USN-2308-1Advisory
www.cve.org/CVERecord?id=CVE-2014-5139REPORT
security-tracker.debian.org/tracker/CVE-2014-5139Advisory