Cloudanix VulnDB

CVE-2014-3511

None

CVSS

—

EPSS

14.1%

Published

Aug 13, 2014

CISA due date

—

The record

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 openssl 0 1.0.1i-1
Debian:12 openssl 0 1.0.1i-1
Debian:13 openssl 0 1.0.1i-1
Debian:7 openssl 0 1.0.1e-2+deb7u12
Mageia:3 openssl 0 1.0.1e-1.10.mga3
Mageia:4 openssl 0 1.0.1e-8.7.mga4
Red Hat:enterprise_linux:6::client openssl 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::client openssl-debuginfo 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::client openssl-devel 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::client openssl-perl 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::client openssl-static 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::computenode openssl 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::computenode openssl-debuginfo 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::computenode openssl-devel 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::computenode openssl-perl 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::computenode openssl-static 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::hypervisor rhev-hypervisor6 0 0:6.6-20150123.1.el6ev
Red Hat:enterprise_linux:6::server openssl 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::server openssl-debuginfo 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::server openssl-devel 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::server openssl-perl 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::server openssl-static 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::workstation openssl 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::workstation openssl-debuginfo 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::workstation openssl-devel 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::workstation openssl-perl 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:6::workstation openssl-static 0 0:1.0.1e-16.el6_5.15
Red Hat:enterprise_linux:7::client openssl 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::client openssl-debuginfo 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::client openssl-devel 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::client openssl-libs 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::client openssl-perl 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::client openssl-static 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::computenode openssl 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::computenode openssl-debuginfo 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::computenode openssl-devel 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::computenode openssl-libs 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::computenode openssl-perl 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::computenode openssl-static 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::server openssl 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::server openssl-debuginfo 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::server openssl-devel 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::server openssl-libs 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::server openssl-perl 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::server openssl-static 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::workstation openssl 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::workstation openssl-debuginfo 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::workstation openssl-devel 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::workstation openssl-libs 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::workstation openssl-perl 0 1:1.0.1e-34.el7_0.4
Red Hat:enterprise_linux:7::workstation openssl-static 0 1:1.0.1e-34.el7_0.4
Red Hat:rhev_manager:3 rhevm-spice-client 0 0:3.5-2.el6
Red Hat:rhev_manager:3 rhevm-spice-client-x64-cab 0 0:3.5-2.el6
Red Hat:rhev_manager:3 rhevm-spice-client-x64-msi 0 0:3.5-2.el6
Red Hat:rhev_manager:3 rhevm-spice-client-x86-cab 0 0:3.5-2.el6
Red Hat:rhev_manager:3 rhevm-spice-client-x86-msi 0 0:3.5-2.el6
Red Hat:storage:2.1:server:el6 openssl 0 0:1.0.1e-16.el6_5.15
Red Hat:storage:2.1:server:el6 openssl-debuginfo 0 0:1.0.1e-16.el6_5.15
Red Hat:storage:2.1:server:el6 openssl-devel 0 0:1.0.1e-16.el6_5.15
Red Hat:storage:2.1:server:el6 openssl-perl 0 0:1.0.1e-16.el6_5.15
Red Hat:storage:2.1:server:el6 openssl-static 0 0:1.0.1e-16.el6_5.15
Ubuntu:14.04:LTS openssl 0 1.0.1f-1ubuntu2.5
openSUSE:Tumbleweed libressl 0 2.5.0-1.1
openSUSE:Tumbleweed openssl-1_1 0 1.1.1l-1.2

Related vulnerabilities