PT-2014-1702 · Gentoo+7 · Gentoo Linux+7
Publicado
2014-08-06
·
Atualizado
2024-06-15
·
CVE-2014-3511
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions prior to 1.0.1j
Gentoo Linux (affected versions not specified)
Description
The issue allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue. This can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information. The vulnerability is in the
ssl23 get client hello function in s23 srvr.c.Recommendations
For OpenSSL versions prior to 1.0.1j, update to version 1.0.1j or later to resolve the issue.
As a temporary workaround, consider restricting the use of TLS 1.0 until a patch is available.
Avoid using the
ssl23 get client hello function in s23 srvr.c until the issue is resolved.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Gentoo Linux
Ibm Aix
Openssl
Red Hat
Suse
Ubuntu