CVSS 3.1
7.4 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2014-0224
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.
Severity
- EPSS
- 95% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-326
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- filezilla-project:filezilla_server
- mariadb:mariadb
- nodejs:node.js
- openssl:openssl
- opensuse:opensuse
- python:python
- redhat:enterprise_linux
- redhat:jboss_enterprise_application_platform
- redhat:jboss_enterprise_web_platform
- redhat:jboss_enterprise_web_server
- redhat:storage
- siemens:application_processing_engine_firmware
- siemens:cp1543-1_firmware
- siemens:rox_firmware
- siemens:s7-1500_firmware