CVE-2014-3568

OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to…

published October 19, 2014

CVSS

—

EPSS

14%

Percentile

96.5

In the wild

Unconfirmed

What it is

OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.13976 · 96.5th percentile
Published: 2014-10-19T01:00Z

EPSS history

Timeline

19 OCT 01:00Z
OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to…
cvelistv5