CVSS 3.1
3.4 lowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:NCVE-2014-3566
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 100% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-310, CWE-329
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:mac_os_x
- debian:debian_linux
- fedoraproject:fedora
- ibm:aix
- ibm:vios
- mageia:mageia
- netbsd:netbsd
- novell:suse_linux_enterprise_desktop
- novell:suse_linux_enterprise_server
- novell:suse_linux_enterprise_software_development_kit
- openssl:openssl
- opensuse:opensuse
- oracle:database
- redhat:enterprise_linux
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_desktop_supplementary
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_supplementary
- redhat:enterprise_linux_workstation
- redhat:enterprise_linux_workstation_supplementary
References
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc
- http://advisories.mageia.org/MGASA-2014-0416.html
- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html