UpHeron
All vulnerabilities

Servers and applications

CVE-2014-0224

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Severity
High 7.4
Published
5 Jun 2014
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
0.10.29, 1.0.0m, 1.0.1h, 2.7.8, 3.4.2, 10.0.13
Sources
NVD

Affected software

SoftwareAffected versions
MariaDBServers and applications · cpe:a:mariadb:mariadb
  • From 10.0.0 before 10.0.13
Node.jsServers and applications · cpe:a:nodejs:node.js
  • Every version before 0.10.29
OpenSSLServers and applications · cpe:a:openssl:openssl
  • Every version before 0.9.8za
  • From 1.0.0 before 1.0.0m
  • From 1.0.1 before 1.0.1h
PythonServers and applications · cpe:a:python:python
  • From 2.7.0 before 2.7.8
  • From 3.4.0 before 3.4.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-0224
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-0224