NVD

Id
31696  
Name
CVE-2014-3511  
Description
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-08-13  
Modified Date
2017-01-06  
Seq
2014-3511  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
166399 31696 CVE-2014-3511 NetBSD-SA2014-008  View
166400 31696 CVE-2014-3511 http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc  View
166401 31696 CVE-2014-3511 http://linux.oracle.com/errata/ELSA-2014-1052.html  View
166402 31696 CVE-2014-3511 FEDORA-2014-9301  View
166403 31696 CVE-2014-3511 FEDORA-2014-9308  View
166404 31696 CVE-2014-3511 openSUSE-SU-2014:1052  View
166405 31696 CVE-2014-3511 SSRT101818  View
166406 31696 CVE-2014-3511 SSRT101894  View
166407 31696 CVE-2014-3511 HPSBMU03267  View
166408 31696 CVE-2014-3511 SSRT101846  View
166409 31696 CVE-2014-3511 HPSBMU03304  View
166410 31696 CVE-2014-3511 HPSBMU03263  View
166411 31696 CVE-2014-3511 HPSBMU03261  View
166412 31696 CVE-2014-3511 RHSA-2015:0126  View
166413 31696 CVE-2014-3511 RHSA-2015:0197  View
166414 31696 CVE-2014-3511 58962  View
166415 31696 CVE-2014-3511 59700  View
166416 31696 CVE-2014-3511 59710  View
166417 31696 CVE-2014-3511 60022  View
166418 31696 CVE-2014-3511 60221  View
166419 31696 CVE-2014-3511 60493  View
166420 31696 CVE-2014-3511 60684  View
166421 31696 CVE-2014-3511 60803  View
166422 31696 CVE-2014-3511 61017  View
166423 31696 CVE-2014-3511 61043  View
166424 31696 CVE-2014-3511 61100  View
166425 31696 CVE-2014-3511 61139  View
166426 31696 CVE-2014-3511 61184  View
166427 31696 CVE-2014-3511 GLSA-201412-39  View
166428 31696 CVE-2014-3511 http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15564.html  View
166429 31696 CVE-2014-3511 http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240  View
166430 31696 CVE-2014-3511 http://www-01.ibm.com/support/docview.wss?uid=swg21682293  View
166431 31696 CVE-2014-3511 http://www-01.ibm.com/support/docview.wss?uid=swg21683389  View
166432 31696 CVE-2014-3511 http://www-01.ibm.com/support/docview.wss?uid=swg21686997  View
166433 31696 CVE-2014-3511 http://www.arubanetworks.com/support/alerts/aid-08182014.txt  View
166434 31696 CVE-2014-3511 DSA-2998  View
166435 31696 CVE-2014-3511 http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm  View
166436 31696 CVE-2014-3511 69079  View
166437 31696 CVE-2014-3511 1030693  View
166438 31696 CVE-2014-3511 http://www.splunk.com/view/SP-CAAANHS  View
166439 31696 CVE-2014-3511 http://www.tenable.com/security/tns-2014-06  View
166440 31696 CVE-2014-3511 openssl-cve20143511-sec-bypass(95162)  View
166441 31696 CVE-2014-3511 https://bugzilla.redhat.com/show_bug.cgi?id=1127504  View
166442 31696 CVE-2014-3511 https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=280b1f1ad12131defcd986676a8fc9717aaa601b  View
166443 31696 CVE-2014-3511 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888  View
166444 31696 CVE-2014-3511 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380  View
166445 31696 CVE-2014-3511 https://kc.mcafee.com/corporate/index?page=content&id=SB10084  View
166446 31696 CVE-2014-3511 [syslog-ng-announce] 20140910 syslog-ng Premium Edition 5 LTS (5.0.6a) has been released  View
166447 31696 CVE-2014-3511 https://techzone.ergon.ch/CVE-2014-3511  View
166448 31696 CVE-2014-3511 FreeBSD-SA-14:18  View
166449 31696 CVE-2014-3511 https://www.openssl.org/news/secadv_20140806.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14941 JVNDB-2014-003816 OpenSSL の s23_srvr.c 内の ssl23_get_client_hello 関数における TLS1.0 の使用を強制される脆弱性 OpenSSL の s23_srvr.c 内の ssl23_get_client_hello 関数には、TLS1.0 の使用を強制される脆弱性が存在します。 CVE-2014-3511 70799 CVE-2014-3511 31696 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003816.html 2014-08-06 2016-10-07 View