CVE-2014-8730 json
The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 1…
published 2014-12-10 11 y ago modified 2026-06-17 4 mo ago also EUVD-2014-8562
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.8%
- EPSS 13.8% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3.0 through 11.5.1, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, PEM 11.3.0 through 11.6.0, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1 and BIG-IQ Cloud and Security 4.0.0 through 4.4.0 and Device 4.2.0 through 4.4.0, when using TLS 1.x before TLS 1.2, does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). NOTE: the scope of this identifier is limited to the F5 implementation only. Other vulnerable implementations should receive their own CVE ID, since this is not a vulnerability within the design of TLS 1.x itself.
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2014-8730 updated cvss 5.0
TLS: incorrect check of padding bytes when using CBC cipher suites
-
Red Hat Enterprise Linux 5 nss, openssl Red Hat Enterprise Linux 6 nss, openssl, nss-tools, nss-sysinit, openssl-perl Red Hat Enterprise Linux 7 nss, openssl, nss-tools, nss-sysinit, openssl-libs, openssl-perlnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
13.83% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-310 Cryptographic Issues
References
-
marc.info
/?l=bugtraq&m=144372772101168&w=2
vendor-advisory
-
devcentral.f5.com
/articles/cve-2014-8730-padding-issue-8151
vendor-advisory
-
support.f5.com
/kb/en-us/solutions/public/15000/800/sol15882.html
vendor-advisory
-
secunia.com
/advisories/62167
third-party-advisory
-
openwall.com
/lists/oss-security/2014/12/09/27
mailing-list
- www-01.ibm.com /support/docview.wss?uid=swg21693495
-
secunia.com
/advisories/62224
third-party-advisory
- support.lenovo.com /us/en/product_security/poodle
- imperialviolet.org /2014/12/08/poodleagain.html
- h20564.www2.hpe.com /portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04819635
- www-01.ibm.com /support/docview.wss?uid=swg21693271
- www-01.ibm.com /support/docview.wss?uid=swg21693337
-
secunia.com
/advisories/62388
third-party-advisory
- support.lenovo.com /product_security/poodle
Sources
- CVE List CVE-2014-8730
- NVD CVE-2014-8730
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.