PT-2014-8653 · Openssl · Polarssl

Published 2014-11-22 · Updated 2024-06-15 · CVE-2014-8627

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PolarSSL version 1.3.8

Description The issue allows remote attackers to conduct downgrade attacks due to improper negotiation of the signature algorithm.

Recommendations For version 1.3.8, update to a newer version that properly negotiates the signature algorithm to prevent downgrade attacks.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-8627

MGASA-2014-0481

OPENSUSE-SU-2024:10088-1

OPENSUSE-SU-2024:12903-1

Affected Products

Polarssl

References · 15

• https://osv.dev/vulnerability/openSUSE-SU-2024:12903-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10088-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8627 · Security Note
• https://advisories.mageia.org/MGASA-2014-0481.html · Security Note
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/11/06/4 · Note
• https://suse.com/security/cve/CVE-2015-1182 · Note
• https://suse.com/security/cve/CVE-2014-8628 · Note
• https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released · Note
• https://suse.com/security/cve/CVE-2015-7575 · Note
• https://suse.com/security/cve/CVE-2014-8627 · Note
• http://secunia.com/advisories/61220 · Note
• https://bugs.mageia.org/show_bug.cgi?id=14472 · Note
• https://suse.com/security/cve/CVE-2015-5291 · Note