CVE-2014-0224
Fixed in a distro release EPSS 95%
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.
Products: openssl, redhat jboss_enterprise_application_platform, redhat jboss_enterprise_web_platform, redhat jboss_enterprise_web_server, redhat storage, fedoraproject fedora, opensuse, redhat enterprise_linux, filezilla-project filezilla_server, siemens application_processing_engine_firmware, siemens cp1543-1_firmware, siemens s7-1500_firmware, siemens rox_firmware, mariadb, python, nodejs node.js
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openssl | 1.0.1h-1 |
| Debian 13 | openssl | 1.0.1h-1 |
| Debian 14 | openssl | 1.0.1h-1 |
| Debian 6.0 | openssl | 0.9.8o-4squeeze15 |
| Debian 6.0 | openssl | 0.9.8o-4squeeze16 |
| Debian 7 | openssl | 1.0.1e-2+deb7u10 |
| Red Hat Enterprise Linux 5 | openssl | 0:0.9.8e-27.el5_10.3 |
| Red Hat Enterprise Linux 5 | openssl-debuginfo | 0:0.9.8e-27.el5_10.3 |
| Red Hat Enterprise Linux 5 | openssl-devel | 0:0.9.8e-27.el5_10.3 |
| Red Hat Enterprise Linux 5 | openssl-perl | 0:0.9.8e-27.el5_10.3 |
| Red Hat Enterprise Linux 5 | openssl097a | 0:0.9.7a-12.el5_10.1 |
| Red Hat Enterprise Linux 5 | openssl097a-debuginfo | 0:0.9.7a-12.el5_10.1 |
| Red Hat Enterprise Linux 6 | openssl | 0:1.0.1e-16.el6_5.14 |
| Red Hat Enterprise Linux 6 | openssl-debuginfo | 0:1.0.1e-16.el6_5.14 |
| Red Hat Enterprise Linux 6 | openssl-devel | 0:1.0.1e-16.el6_5.14 |
| Red Hat Enterprise Linux 6 | openssl-perl | 0:1.0.1e-16.el6_5.14 |
| Red Hat Enterprise Linux 6 | openssl-static | 0:1.0.1e-16.el6_5.14 |
| Red Hat Enterprise Linux 6 | openssl098e | 0:0.9.8e-18.el6_5.2 |
| Red Hat Enterprise Linux 6 | openssl098e-debuginfo | 0:0.9.8e-18.el6_5.2 |
| Red Hat Enterprise Linux 6 | rhev-hypervisor6 | 0:6.5-20140603.1.el6ev |
| Red Hat Enterprise Linux 7 | openssl | 1:1.0.1e-34.el7_0.3 |
| Red Hat Enterprise Linux 7 | openssl-debuginfo | 1:1.0.1e-34.el7_0.3 |
| Red Hat Enterprise Linux 7 | openssl-devel | 1:1.0.1e-34.el7_0.3 |
| Red Hat Enterprise Linux 7 | openssl-libs | 1:1.0.1e-34.el7_0.3 |
| Red Hat Enterprise Linux 7 | openssl-perl | 1:1.0.1e-34.el7_0.3 |
| Red Hat Enterprise Linux 7 | openssl-static | 1:1.0.1e-34.el7_0.3 |
| Red Hat Enterprise Linux 7 | openssl098e | 0:0.9.8e-29.el7_0.2 |
| Red Hat Enterprise Linux 7 | openssl098e-debuginfo | 0:0.9.8e-29.el7_0.2 |
| Red Hat rhel els 4 | openssl | 0:0.9.7a-43.22.el4 |
| Red Hat rhel els 4 | openssl-debuginfo | 0:0.9.7a-43.22.el4 |
| Red Hat rhel els 4 | openssl-devel | 0:0.9.7a-43.22.el4 |
| Red Hat rhel els 4 | openssl-perl | 0:0.9.7a-43.22.el4 |
| Red Hat rhel eus 5.9 | openssl | 0:0.9.8e-26.el5_9.4 |
| Red Hat rhel eus 5.9 | openssl-debuginfo | 0:0.9.8e-26.el5_9.4 |
| Red Hat rhel eus 5.9 | openssl-devel | 0:0.9.8e-26.el5_9.4 |
| Red Hat rhel eus 5.9 | openssl-perl | 0:0.9.8e-26.el5_9.4 |
| Red Hat rhel eus 6.3 | openssl | 0:1.0.0-25.el6_3.3 |
| Red Hat rhel eus 6.3 | openssl-debuginfo | 0:1.0.0-25.el6_3.3 |
| Red Hat rhel eus 6.3 | openssl-devel | 0:1.0.0-25.el6_3.3 |
| Red Hat rhel eus 6.3 | openssl-perl | 0:1.0.0-25.el6_3.3 |
| Red Hat rhel eus 6.3 | openssl-static | 0:1.0.0-25.el6_3.3 |
| Red Hat rhel eus 6.4 | openssl | 0:1.0.0-27.el6_4.4 |
| Red Hat rhel eus 6.4 | openssl-debuginfo | 0:1.0.0-27.el6_4.4 |
| Red Hat rhel eus 6.4 | openssl-devel | 0:1.0.0-27.el6_4.4 |
| Red Hat rhel eus 6.4 | openssl-perl | 0:1.0.0-27.el6_4.4 |
| Red Hat rhel eus 6.4 | openssl-static | 0:1.0.0-27.el6_4.4 |
| Red Hat rhel mission critical 5.6 | openssl | 0:0.9.8e-12.el5_6.12 |
| Red Hat rhel mission critical 5.6 | openssl-debuginfo | 0:0.9.8e-12.el5_6.12 |
| Red Hat rhel mission critical 5.6 | openssl-devel | 0:0.9.8e-12.el5_6.12 |
| Red Hat rhel mission critical 5.6 | openssl-perl | 0:0.9.8e-12.el5_6.12 |
| Red Hat rhel mission critical 6.2 | openssl | 0:1.0.0-20.el6_2.7 |
| Red Hat rhel mission critical 6.2 | openssl-debuginfo | 0:1.0.0-20.el6_2.7 |
| Red Hat rhel mission critical 6.2 | openssl-devel | 0:1.0.0-20.el6_2.7 |
| Red Hat rhel mission critical 6.2 | openssl-perl | 0:1.0.0-20.el6_2.7 |
| Red Hat rhel mission critical 6.2 | openssl-static | 0:1.0.0-20.el6_2.7 |
| Red Hat storage 2.1 server el6 | openssl | 0:1.0.1e-16.el6_5.14 |
| Red Hat storage 2.1 server el6 | openssl-debuginfo | 0:1.0.1e-16.el6_5.14 |
| Red Hat storage 2.1 server el6 | openssl-devel | 0:1.0.1e-16.el6_5.14 |
| Red Hat storage 2.1 server el6 | openssl-perl | 0:1.0.1e-16.el6_5.14 |
| Red Hat storage 2.1 server el6 | openssl-static | 0:1.0.1e-16.el6_5.14 |
| SUSE Linux Enterprise Desktop 12 | compat-openssl098 | 0.9.8j-70.2 |
| SUSE Linux Enterprise Desktop 12 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Desktop 12 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Desktop 12 | mariadb | 10.0.16-15.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Module for Legacy 12 | compat-openssl098 | 0.9.8j-70.2 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox | 68.2.0-78.51.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox-branding-SLED | 68-21.9.8 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-atk | 2.26.1-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-cairo | 1.15.10-2.13.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gdk-pixbuf | 2.36.11-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-glib2 | 2.54.3-2.14.7 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gtk3 | 3.10.9-2.15.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-harfbuzz | 1.7.5-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi | 3.2.1.git259-2.3.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-pango | 1.40.14-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nspr | 4.21-29.6.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nss | 3.45-38.9.3 |
| SUSE Linux Enterprise Server 12 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Server 12 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Server 12 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Server 12 | mariadb | 10.0.16-15.1 |
| SUSE Linux Enterprise Server 12 SP1 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Server 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Server 12 SP1 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | mariadb | 10.0.16-15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Software Development Kit 12 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Software Development Kit 12 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Software Development Kit 12 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Software Development Kit 12 | mariadb | 10.0.16-15.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Workstation Extension 12 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Workstation Extension 12 | libqt4-sql-plugins | 4.8.6-7.1 |
| SUSE Linux Enterprise Workstation Extension 12 | mariadb | 10.0.16-15.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP1 | libqt4 | 4.8.6-7.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP1 | libqt4-sql-plugins | 4.8.6-7.1 |
| Ubuntu 14.04 LTS | openssl | 1.0.1f-1ubuntu2.2 |
| Ubuntu 14.04 LTS | openssl098 | 0.9.8o-7ubuntu3.2.14.04.1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 |
| openSUSE Tumbleweed | virtualbox | 5.1.10-2.5 |