CVE-2014-3511
Last modified
CVE-2014-3511 is a vulnerability of currently unknown severity. The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.. EPSS estimates a 13.33% chance of exploitation in the next 30 days.
Description
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openssl | Openssl | 1.0.0 |
| Openssl | Openssl | 1.0.0a |
| Openssl | Openssl | 1.0.0b |
| Openssl | Openssl | 1.0.0c |
| Openssl | Openssl | 1.0.0d |
| Openssl | Openssl | 1.0.0e |
| Openssl | Openssl | 1.0.0f |
| Openssl | Openssl | 1.0.0g |
| Openssl | Openssl | 1.0.0h |
| Openssl | Openssl | 1.0.0i |
| Openssl | Openssl | 1.0.0j |
| Openssl | Openssl | 1.0.0k |
| Openssl | Openssl | 1.0.0l |
| Openssl | Openssl | 1.0.0m |
| Openssl | Openssl | 1.0.1 |
| Openssl | Openssl | 1.0.1a |
| Openssl | Openssl | 1.0.1b |
| Openssl | Openssl | 1.0.1c |
| Openssl | Openssl | 1.0.1d |
| Openssl | Openssl | 1.0.1e |
| Openssl | Openssl | 1.0.1f |
| Openssl | Openssl | 1.0.1g |
| Openssl | Openssl | 1.0.1h |
References
- https://www.openssl.org/news/secadv_20140806.txtVendor Advisory
- https://www.openssl.org/news/secadv_20140806.txtVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-3511?
How severe is CVE-2014-3511?
How do I fix CVE-2014-3511?
Are you affected by CVE-2014-3511?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST