CVE-2014-3572

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct…

published January 9, 2015

CVSS
—
EPSS
7%
Percentile
93.8
In the wild
Unconfirmed
What it is

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06574 · 93.8th percentile
Published
2015-01-09T02:00Z
EPSS history
Timeline
  • 09 JAN 02:00Z
    The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct…
    cvelistv5