WaratekVRT Sign in

CVE-2014-0224 OpenSSL

Affected softwareOpenSSL
Severity7.4 High CVSS 3.1 2 scores
WeaknessCWE-326
Published5 Jun 2014
Updated17 Jun 2026

Description

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · 3 exploits · earliest 2024-05-06.
  • CISA Vulnrichment no assessment published
  • Indexed PoC 4 indexed Published artifacts you can open, in GitHub PoC; first seen 2014-06-12.
  • EPSS 95% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2014-0224 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation fortinet.com /content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf 2024-05-06
Exploit reference VulnCheck XDB 40c679c9e228 Exploit type: remote-with-credentials 2014-06-12
Exploit reference VulnCheck XDB a6335780e72e Exploit type: initial-access 2014-07-08
Exploit reference VulnCheck XDB ddb93e835d78 Exploit type: remote-with-credentials 2014-07-16

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC This script is designed for detection of vulnerable servers (CVE-2014-0224.) in a wide range of configurations. It attempts to negotiate using each affected protocol version (SSLv3, TLSv1, TLSv1.1, and TLSv1.2) advertising a comprehensive set of ciphers. 39 2014-06-12
GitHub PoC ssllabs/openssl-ccs-cve-2014-0224 15 2014-07-15
GitHub PoC secretnonempty/CVE-2014-0224 9 2014-07-16
GitHub PoC Used for evaluating hosts for CVE-2014-0224 2014-07-10

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.4 HIGH v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.4 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N NVD Primary published
CVSS 2.0 5.8 none AV:N/AC:M/Au:N/C:P/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2017 ↗ CPU 2017-Q4 Oracle Communications Applications / Security (OpenSSL) (4.x)
Oracle Critical Patch Update October 2016 ↗ CPU 2016-Q4 Oracle Communications Applications / OpenSSL (9.7.3, 9.9.1, 10.4.1, 12.1.1 and earlier)
Oracle Communications Applications / OpenSSL (Ecz7.3m1p4 and earlier)
Oracle Communications Applications / OpenSSL (Pcz2.0.0m4p5 and earlier)
Oracle Critical Patch Update July 2016 ↗ CPU 2016-Q3 Oracle Financial Services Applications / Admin and setup (14.1 , 14.2)
Oracle Critical Patch Update January 2015 ↗ CPU 2015-Q1 Oracle Enterprise Manager Grid Control / Enterprise Manager Ops Center (11.1.3, 12.1.4)
Oracle Fusion Middleware / Oracle Exalogic Infrastructure (2.0.6.2.0 (for all X2-2, X3-2, X4-2))
Oracle Sun Systems Products Suite / Integrated Lights Out Manager(ILOM) (ILOM prior to 3.2.4)
Oracle Sun Systems Products Suite / SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers (XCP prior to XCP 1118)
Oracle Virtualization / Oracle VM VirtualBox (VirtualBox prior to 3.2.24, 4.0.26, 4.1.34, 4.2.26, 4.3.14)
Oracle's note: This fix also addresses CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 and CVE-2014-0076.
Oracle Critical Patch Update October 2014 ↗ CPU 2014-Q4 Oracle Fusion Middleware / Studio (3.1)
Oracle's note: This fix also addresses CVE-2014-3470,CVE-2010-5298,CVE-2014-0221,CVE-2014-0195,CVE-2014-0198.
Oracle MySQL / SERVER:SSL:OpenSSL (5.6.19 and earlier)
Oracle's note: This fix also addresses CVE-2010-5298,CVE-2014-0195,CVE-2014-0198,CVE-2014-0221,CVE-2014-3470
Oracle Sun Systems Products Suite / XCP (XCP prior to XCP2221)
Oracle Critical Patch Update July 2014 ↗ CPU 2014-Q3 Oracle E-Business Suite / IAS For App Technology (11.5.10.2)
Oracle Virtualization / OpenSSL (4.63, 4.71, 5.0, 5.1)
Oracle's note: This fix also addresses CVE-2010-5298, CVE-2013-6449 and CVE-2013-6450, CVE-2014-0195, CVE-2014-0198, CVE-2014-0221 and CVE-2014-3470.

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications OpenSSL Ecz7.3m1p4 and earlier 9.7.3 · 9.9.1 · 10.4.1
Oracle Communications Applications Security (OpenSSL) 4.x 4
Oracle E-Business Suite IAS For App Technology 11.5.10.2 11.5.10.2
Oracle Enterprise Manager Grid Control Enterprise Manager Ops Center 11.1.3, 12.1.4 11.1.3 · 12.1.4
Oracle Financial Services Applications Admin and setup 14.1 , 14.2 14.1 · 14.2
Oracle Fusion Middleware Oracle Exalogic Infrastructure 2.0.6.2.0 (for all X2-2, X3-2, X4-2)
Oracle Fusion Middleware Studio 3.1 3.1
Oracle MySQL SERVER:SSL:OpenSSL 5.6.19 and earlier
Oracle Sun Systems Products Suite Integrated Lights Out Manager(ILOM) ILOM prior to 3.2.4 3.2.4
Oracle Sun Systems Products Suite SPARC Enterprise M3000, M4000, M5000, M8000, M9000 Servers XCP prior to XCP 1118 1118
Oracle Sun Systems Products Suite XCP XCP prior to XCP2221
Oracle Virtualization OpenSSL 4.63, 4.71, 5.0, 5.1 4.63 · 4.71 · 5.0 · 5.1
Oracle Virtualization Oracle VM VirtualBox VirtualBox prior to 3.2.24, 4.0.26, 4.1.34, 4.2.26, 4.3.14 3.2.24 · 4.0.26 · 4.1.34 · 4.2.26 · 4.3.14

Products and versions

16 products, 24 version entries
SourceVendorProductSchemeAffected versions
nvd fedoraproject fedora generic 19 · 20
nvd filezilla-project filezilla server generic ＜ 0.9.45
nvd mariadb mariadb generic ≥ 10.0.0 and ＜ 10.0.13
nvd nodejs node.js generic ＜ 0.10.29
nvd openssl openssl generic ＜ 0.9.8 · ≥ 1.0.0 and ＜ 1.0.0 · ≥ 1.0.1 and ＜ 1.0.1
nvd opensuse opensuse generic 13.1 · 13.2
nvd python python generic ≥ 2.7.0 and ＜ 2.7.8 · ≥ 3.4.0 and ＜ 3.4.2
nvd redhat enterprise linux generic 4 · 5 · 6.0
nvd redhat jboss enterprise application platform generic 5.2.0 · 6.2.3
nvd redhat jboss enterprise web platform generic 5.2.0
nvd redhat jboss enterprise web server generic 2.0.1
nvd redhat storage generic 2.1
nvd siemens application processing engine firmware generic ＜ 2.0.2
nvd siemens cp1543-1 firmware generic ＜ 1.1.25
nvd siemens rox firmware generic ＜ 1.16.1
nvd siemens s7-1500 firmware generic ＜ 1.6

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, MYSQL PROTOCOL, SECURITY (OPENSSL), SSL, NETWORKING, SEE NOTE 3, NO AUTH REMOTE EXPLOIT, SERVER:SSL:OPENSSL, SEE NOTE 2, XCP, XCP FIRMWARE, NETWORK INFRA FRAMEWORK, IAS FOR APP TECHNOLOGY, HTTPS, ADMIN AND SETUP, TLS, SEE NOTE 1, SSL/TLS, STUDIO, OPENSSL **Products:** ORACLE FINANCIAL SERVICES LENDING AND LEASING, ORACLE EXALOGIC INFRASTRUCTURE, ORACLE ENTERPRISE SESSION BORDER CONTROLLER, FUJITSU M10-1, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE ENTERPRISE COMMUNICATIONS BROKER, ORACLE MYSQL, ORACLE ENTERPRISE MANAGER GRID CONTROL, M8000, ENTERPRISE MANAGER OPS CENTER, M9000 SERVERS, ORACLE APPLICATIONS TECHNOLOGY STACK, FUJITSU M10-4, ORACLE COMMUNICATIONS POLICY MANAGEMENT, ORACLE SECURE GLOBAL DESKTOP (SGD), ORACLE E-BUSINESS SUITE, ORACLE VIRTUALIZATION, ORACLE FUSION MIDDLEWARE, ORACLE VM VIRTUALBOX, ORACLE SUN SYSTEMS PRODUCTS SUITE, M5000, M4000, MYSQL SERVER, FUJITSU M10-4S SERVERS, OPENSSL, INTEGRATED LIGHTS OUT MANAGER(ILOM), ORACLE COMMUNICATIONS APPLICATIONS, ORACLE ENDECA INFORMATION DISCOVERY STUDIO, TEKELEC HLR ROUTER, SPARC ENTERPRISE M3000

References

URLTags
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc Third Party Advisory
http://ccsinjection.lepidum.co.jp Third Party Advisory
http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.html Third Party Advisory
http://esupport.trendmicro.com/solution/en-US/1103813.aspx Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629 Not Applicable
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195 Not Applicable
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29217 Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-1053.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html Third Party Advisory

Timeline
Published2014-06-05By the CVE Program.
VulnCheck KEV: earliest evidence2024-05-06Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.