CVE-2014-3566

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle…

Low · published October 15, 2014

Patch now

High probability of exploitation

CVSS calls it low at 3.4. It sits in the 100.0th percentile for exploit probability.

CVSS v3.1
3.4
EPSS
100%
Percentile
100.0
In the wild
Unconfirmed
What it is

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.99999 · 100.0th percentile
Published
2014-10-15T00:00Z
EPSS history
Timeline
  • 15 OCT 00:00Z
    The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle…
    cvelistv5