Skip to content
Fencer Intel
high 7.4

CVE-2014-0224 in the critical feed json

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, wh…

published 12y ago modified 4mo ago also EUVD-2014-0267

cvss
7.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
95.3%
EPSS 95.3% chance of exploitation in 30 days, percentile 99.8%
public exploits
1
Metasploit

Summary

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Patch / fix

  • openssl openssl 0.9.8za, 1.0.0m, 1.0.1h
  • filezilla-project filezilla_server 0.9.45
  • mariadb mariadb 10.0.13
  • python python 2.7.8, 3.4.2
  • nodejs node.js 0.10.29
  • siemens application_processing_engine_firmware 2.0.2
  • siemens cp1543-1_firmware 1.1.25
  • siemens s7-1500_firmware 1.6
  • siemens rox_firmware 1.16.1
  • openssl Debian 14, Debian 13, Debian 12 1.0.1h-1

debian advisories DEBIAN-CVE-2014-0224

  • openssl Ubuntu 14.04 LTS 1.0.1f-1ubuntu2.2
  • openssl098 Ubuntu 14.04 LTS 0.9.8o-7ubuntu3.2.14.04.1

ubuntu advisories UBUNTU-CVE-2014-0224

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl storage 2.1, RHEL 6 1.0.1e-16.el6_5.14
  • openssl-perl storage 2.1, RHEL 6 1.0.1e-16.el6_5.14
  • openssl RHEL 7 1:1.0.1e-34.el7_0.3
  • openssl-libs RHEL 7 1:1.0.1e-34.el7_0.3
  • openssl-perl RHEL 7 1:1.0.1e-34.el7_0.3
  • openssl098e RHEL 7 0.9.8e-29.el7_0.2
  • rhev-hypervisor6 RHEL 6 6.5-20140603.1.el6ev
  • openssl RHEL 5 0.9.8e-27.el5_10.3

red hat advisories RHSA-2014:0628RHSA-2014:0679RHSA-2014:0625RHSA-2014:0680RHSA-2014:0629RHSA-2014:0627

  • mariadb SLES for SAP 12, SLES 12, SLED 12 +2 more 10.0.16-15.1
  • compat-openssl098 SLED 12, SLE Module for Legacy 12 0.9.8j-70.2
  • libqt4 SLES 12 SP1, SLES 12, SLED 12 SP1 +7 more 4.8.6-7.1
  • libqt4-sql-plugins SLES 12 SP1, SLES 12, SLED 12 SP1 +7 more 4.8.6-7.1
  • firefox-atk SLES 11 SP4-LTSS 2.26.1-2.8.4
  • mozilla-nss SLES 11 SP4-LTSS 3.45-38.9.3
  • firefox-gtk3 SLES 11 SP4-LTSS 3.10.9-2.15.3
  • mozilla-nspr SLES 11 SP4-LTSS 4.21-29.6.1

suse advisories SUSE-SU-2019:14246-1SUSE-SU-2015:0743-1SUSE-SU-2015:0305-1SUSE-SU-403SUSE-SU-403 Forbidden-1

  • virtualbox openSUSE Tumbleweed 5.1.10-2.5
  • openssl-1_1 openSUSE Tumbleweed 1.1.1l-1.2

opensuse advisories openSUSE-SU-2024:10020-1openSUSE-SU-2024:11127-1

Is CVE-2014-0224 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-0224 updated cvss 5.8

openssl: SSL/TLS MITM vulnerability

  • Red Hat JBoss Enterprise Application Platform 5 openssl Red Hat JBoss Enterprise Application Platform 6 openssl
    affected: no fix available
  • Red Hat JBoss Enterprise Web Server 1 openssl
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux (v. 5 server) openssl 0.9.8e-27.el5_10.3, openssl097a 0.9.7a-12.el5_10.1, openssl-perl 0.9.8e-27.el5_10.3
    fixed: vendor fix RHSA-2014:0624
  • Red Hat Enterprise Linux AS (v. 4 ELS) openssl 0.9.7a-43.22.el4, openssl-perl 0.9.7a-43.22.el4
    fixed: vendor fix RHSA-2014:0627
  • Red Hat Enterprise Linux Client (v. 7) openssl 1.0.1e-34.el7_0.3, openssl098e 0.9.8e-29.el7_0.2, openssl-libs 1.0.1e-34.el7_0.3 Red Hat Enterprise Linux Client Optional (v. 7) openssl-perl 1.0.1e-34.el7_0.3
    fixed: vendor fix RHSA-2014:0679
  • Red Hat Enterprise Linux Compute Node EUS (v. 6.3) openssl 1.0.0-25.el6_3.3 Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.3) openssl 1.0.0-25.el6_3.3, openssl-perl 1.0.0-25.el6_3.3 Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) openssl 1.0.0-27.el6_4.4, openssl-perl 1.0.0-27.el6_4.4
    fixed: vendor fix RHSA-2014:0627
  • Red Hat Enterprise Linux ComputeNode (v. 7) openssl 1.0.1e-34.el7_0.3, openssl098e 0.9.8e-29.el7_0.2, openssl-libs 1.0.1e-34.el7_0.3 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-perl 1.0.1e-34.el7_0.3
    fixed: vendor fix RHSA-2014:0679
  • Red Hat Enterprise Linux Desktop (v. 5 client) openssl 0.9.8e-27.el5_10.3, openssl097a 0.9.7a-12.el5_10.1, openssl-perl 0.9.8e-27.el5_10.3
    fixed: vendor fix RHSA-2014:0624
show 22 more
  • Red Hat Enterprise Linux Desktop (v. 6) openssl 1.0.1e-16.el6_5.14, openssl098e 0.9.8e-18.el6_5.2
    fixed: vendor fix RHSA-2014:0626
  • Red Hat Enterprise Linux Desktop Optional (v. 6) openssl 1.0.1e-16.el6_5.14, openssl-perl 1.0.1e-16.el6_5.14
    fixed: vendor fix RHSA-2014:0625
  • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) openssl 0.9.8e-27.el5_10.3
    fixed: vendor fix RHSA-2014:0624
  • Red Hat Enterprise Linux ES (v. 4 ELS) openssl 0.9.7a-43.22.el4, openssl-perl 0.9.7a-43.22.el4 Red Hat Enterprise Linux EUS (v. 5.9 server) openssl 0.9.8e-26.el5_9.4, openssl-perl 0.9.8e-26.el5_9.4
    fixed: vendor fix RHSA-2014:0627
  • Red Hat Enterprise Linux HPC Node (v. 6) openssl 1.0.1e-16.el6_5.14, openssl098e 0.9.8e-18.el6_5.2
    fixed: vendor fix RHSA-2014:0626
  • Red Hat Enterprise Linux HPC Node EUS (v. 6.4) openssl 1.0.0-27.el6_4.4
    fixed: vendor fix RHSA-2014:0627
  • Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl 1.0.1e-16.el6_5.14, openssl-perl 1.0.1e-16.el6_5.14
    fixed: vendor fix RHSA-2014:0625
  • Red Hat Enterprise Linux Long Life (v. 5.6 server) openssl 0.9.8e-12.el5_6.12, openssl-perl 0.9.8e-12.el5_6.12
    fixed: vendor fix RHSA-2014:0627
  • Red Hat Enterprise Linux Server (v. 6) openssl 1.0.1e-16.el6_5.14, openssl098e 0.9.8e-18.el6_5.2
    fixed: vendor fix RHSA-2014:0626
  • Red Hat Enterprise Linux Server (v. 7) openssl 1.0.1e-34.el7_0.3, openssl098e 0.9.8e-29.el7_0.2, openssl-libs 1.0.1e-34.el7_0.3
    fixed: vendor fix RHSA-2014:0679
  • Red Hat Enterprise Linux Server AUS (v. 6.2) openssl 1.0.0-20.el6_2.7 Red Hat Enterprise Linux Server EUS (v. 6.3) openssl 1.0.0-25.el6_3.3 Red Hat Enterprise Linux Server EUS (v. 6.4) openssl 1.0.0-27.el6_4.4
    fixed: vendor fix RHSA-2014:0627
  • Red Hat Enterprise Linux Server Optional (v. 6) openssl 1.0.1e-16.el6_5.14, openssl-perl 1.0.1e-16.el6_5.14
    fixed: vendor fix RHSA-2014:0625
  • Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl 1.0.1e-34.el7_0.3
    fixed: vendor fix RHSA-2014:0679
  • Red Hat Enterprise Linux Server Optional AUS (v. 6.2) openssl 1.0.0-20.el6_2.7, openssl-perl 1.0.0-20.el6_2.7 Red Hat Enterprise Linux Server Optional EUS (v. 6.3) openssl 1.0.0-25.el6_3.3, openssl-perl 1.0.0-25.el6_3.3 Red Hat Enterprise Linux Server Optional EUS (v. 6.4) openssl 1.0.0-27.el6_4.4, openssl-perl 1.0.0-27.el6_4.4
    fixed: vendor fix RHSA-2014:0627
  • Red Hat Enterprise Linux Workstation (v. 6) openssl 1.0.1e-16.el6_5.14, openssl098e 0.9.8e-18.el6_5.2
    fixed: vendor fix RHSA-2014:0626
  • Red Hat Enterprise Linux Workstation (v. 7) openssl 1.0.1e-34.el7_0.3, openssl098e 0.9.8e-29.el7_0.2, openssl-libs 1.0.1e-34.el7_0.3
    fixed: vendor fix RHSA-2014:0679
  • Red Hat Enterprise Linux Workstation Optional (v. 6) openssl 1.0.1e-16.el6_5.14, openssl-perl 1.0.1e-16.el6_5.14
    fixed: vendor fix RHSA-2014:0625
  • Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl 1.0.1e-34.el7_0.3
    fixed: vendor fix RHSA-2014:0679
  • Red Hat JBoss Enterprise Application Platform 5.2
    fixed: vendor fix RHSA-2014:0630
  • Red Hat JBoss Enterprise Application Platform 6.2
    fixed: vendor fix RHSA-2014:0631
  • Red Hat JBoss Web Platform 5.2
    fixed: vendor fix RHSA-2014:0633
  • Red Hat JBoss Web Server 2.0
    fixed: vendor fix RHSA-2014:0632

2 more fixed, 2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit auxiliary/scanner/ssl/openssl_ccs)
  2. Published

Exploit prediction

95.33% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N

Classification

Weakness
  • CWE-326 Inadequate Encryption Strength
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.