1. CVE-Search
  2. CVE-2014-3511
ID CVE-2014-3511
Summary The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.
References
Vulnerable Configurations
  • cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0:beta4:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0:beta4:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0:beta5:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0:beta5:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0e:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0e:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0f:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0f:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0g:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0g:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0h:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0h:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0i:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0i:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0j:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0j:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0k:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0k:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0l:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0l:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.0m:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.0m:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*
  • cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*
    cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 15-11-2017 - 02:29)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:P/A:N
redhat via4
advisories
  • bugzilla
    id 1127504
    title CVE-2014-3511 openssl: TLS protocol downgrade attack
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 6 is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • comment openssl is earlier than 0:1.0.1e-16.el6_5.15
            oval oval:com.redhat.rhsa:tst:20141052001
          • comment openssl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20171929002
        • AND
          • comment openssl-devel is earlier than 0:1.0.1e-16.el6_5.15
            oval oval:com.redhat.rhsa:tst:20141052003
          • comment openssl-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20171929004
        • AND
          • comment openssl-perl is earlier than 0:1.0.1e-16.el6_5.15
            oval oval:com.redhat.rhsa:tst:20141052005
          • comment openssl-perl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20171929008
        • AND
          • comment openssl-static is earlier than 0:1.0.1e-16.el6_5.15
            oval oval:com.redhat.rhsa:tst:20141052007
          • comment openssl-static is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20171929010
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • comment openssl is earlier than 1:1.0.1e-34.el7_0.4
            oval oval:com.redhat.rhsa:tst:20141052010
          • comment openssl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20171929002
        • AND
          • comment openssl-devel is earlier than 1:1.0.1e-34.el7_0.4
            oval oval:com.redhat.rhsa:tst:20141052011
          • comment openssl-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20171929004
        • AND
          • comment openssl-libs is earlier than 1:1.0.1e-34.el7_0.4
            oval oval:com.redhat.rhsa:tst:20141052012
          • comment openssl-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20171929006
        • AND
          • comment openssl-perl is earlier than 1:1.0.1e-34.el7_0.4
            oval oval:com.redhat.rhsa:tst:20141052014
          • comment openssl-perl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20171929008
        • AND
          • comment openssl-static is earlier than 1:1.0.1e-34.el7_0.4
            oval oval:com.redhat.rhsa:tst:20141052015
          • comment openssl-static is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20171929010
    rhsa
    id RHSA-2014:1052
    released 2014-08-13
    severity Moderate
    title RHSA-2014:1052: openssl security update (Moderate)
  • rhsa
    id RHSA-2015:0126
  • rhsa
    id RHSA-2015:0197
rpms
  • openssl-0:1.0.1e-16.el6_5.15
  • openssl-1:1.0.1e-34.el7_0.4
  • openssl-debuginfo-0:1.0.1e-16.el6_5.15
  • openssl-debuginfo-1:1.0.1e-34.el7_0.4
  • openssl-devel-0:1.0.1e-16.el6_5.15
  • openssl-devel-1:1.0.1e-34.el7_0.4
  • openssl-libs-1:1.0.1e-34.el7_0.4
  • openssl-perl-0:1.0.1e-16.el6_5.15
  • openssl-perl-1:1.0.1e-34.el7_0.4
  • openssl-static-0:1.0.1e-16.el6_5.15
  • openssl-static-1:1.0.1e-34.el7_0.4
  • openssl-0:1.0.1e-16.el6_5.15
  • openssl-debuginfo-0:1.0.1e-16.el6_5.15
  • openssl-devel-0:1.0.1e-16.el6_5.15
  • openssl-perl-0:1.0.1e-16.el6_5.15
  • openssl-static-0:1.0.1e-16.el6_5.15
  • rhev-hypervisor6-0:6.6-20150123.1.el6ev
  • rhevm-spice-client-x64-cab-0:3.5-2.el6
  • rhevm-spice-client-x64-msi-0:3.5-2.el6
  • rhevm-spice-client-x86-cab-0:3.5-2.el6
  • rhevm-spice-client-x86-msi-0:3.5-2.el6
refmap via4
bid 69079
confirm
debian DSA-2998
fedora
  • FEDORA-2014-9301
  • FEDORA-2014-9308
freebsd FreeBSD-SA-14:18
gentoo GLSA-201412-39
hp
  • HPSBHF03293
  • HPSBMU03216
  • HPSBMU03260
  • HPSBMU03261
  • HPSBMU03263
  • HPSBMU03267
  • HPSBMU03304
  • SSRT101818
  • SSRT101846
  • SSRT101894
mlist [syslog-ng-announce] 20140910 syslog-ng Premium Edition 5 LTS (5.0.6a) has been released
netbsd NetBSD-SA2014-008
sectrack 1030693
secunia
  • 58962
  • 59700
  • 59710
  • 59756
  • 59887
  • 60022
  • 60221
  • 60377
  • 60493
  • 60684
  • 60803
  • 60810
  • 60890
  • 60917
  • 60921
  • 60938
  • 61017
  • 61043
  • 61100
  • 61139
  • 61184
  • 61775
  • 61959
suse openSUSE-SU-2014:1052
xf openssl-cve20143511-sec-bypass(95162)
Last major update 15-11-2017 - 02:29
Published 13-08-2014 - 23:55
Last modified 15-11-2017 - 02:29
Back to Top