CVE-2014-3572

Published: Jan 9, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.

Affected (26)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

26 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8zc
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.0n
Openssl Openssl	Version 1.0.0o
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j

Related CWEs

CWE-310

References (74)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00021.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142496179803395&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142496289803847&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142720981827617&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142721102728110&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=142895206924048&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=143748090628601&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050155601375&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050205101530&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050254401665&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=144050297101809&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-0066.html

Source: secalert@redhat.com

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150310-ssl

Source: secalert@redhat.com

http://www.debian.org/security/2015/dsa-3125

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:019

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:062

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/71942

Source: secalert@redhat.com

http://www.securitytracker.com/id/1033378

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa88

Source: secalert@redhat.com

https://github.com/openssl/openssl/commit/b15f8769644b00ef7283521593360b7b2135cb63

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10102

Source: secalert@redhat.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10108

Source: secalert@redhat.com

https://support.apple.com/HT204659

Source: secalert@redhat.com

https://support.citrix.com/article/CTX216642

Source: secalert@redhat.com

https://www.openssl.org/news/secadv_20150108.txt

Source: secalert@redhat.com

Vendor Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679