CVE-2014-0224 Weak cryptography in n/a

What is CVE-2014-0224?

CVE-2014-0224 is a high-severity vulnerability in Fedoraproject Fedora, published on 5 Jun 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Weakness: CWE-326

Which versions are affected by CVE-2014-0224?

It affects 16 products.

Products include Fedoraproject Fedora, Filezilla-Project Filezilla Server, Mariadb Mariadb, Nodejs Node.js, Openssl Openssl, Opensuse Opensuse and 10 more.

How do I fix CVE-2014-0224?

Upgrade to a fixed version.

Is CVE-2014-0224 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-0224 exists.

Public exploit code: 1 Metasploit module and 5 proofs of concept on GitHub.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-0224, GHSA-84gm-v5wh-659w, RHSA-2014:0624, RHSA-2014:0626, RHSA-2014:0627, RHSA-2014:0680 and 1 more.