CVE-2014-3566 The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padd...
LowCVSS 3.4
EPSS 100.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/epiphany-browser(Debian:12) | All versions | No fix listed |
| debian/epiphany-browser(Debian:12) | = 43.1-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 44.0-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 44.1-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 44.2-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 44.3-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 44.5-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 44.5-2 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 44.6-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 44~rc-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 45.0-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 45.1-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 45.2-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 45~beta-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 46.0-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 46.0-2 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 46.1-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 46.2-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 46.3-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 46~alpha-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 46~beta-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 47.0-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 47.2-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 47~beta-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 47~rc-1 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/epiphany-browser(Debian:12) | = 48.0-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 48.1-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 48.2-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 48.3-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 48.3-2 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 48.5-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 48.5-2 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 48.5-3 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 48~beta-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 48~rc-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 48~rc-2 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 49.0-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 49.1-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 49.2-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 49.2-2 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 49.2-3 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 50.3-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 50.3-2 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 50.4-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 50.4-2 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 51.0-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 51.1-1 | No fix listed |
| debian/epiphany-browser(Debian:12) | = 51~rc-1 | No fix listed |
| debian/epiphany-browser(Debian:13) | All versions | No fix listed |
| debian/epiphany-browser(Debian:13) | = 48.3-2 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 48.5-0+deb13u1 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 48.5-1 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 48.5-2 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 48.5-3 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 49.0-1 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 49.1-1 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 49.2-1 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 49.2-2 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 49.2-3 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 50.3-1 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 50.3-2 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 50.4-1 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 50.4-2 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 51.0-1 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 51.1-1 | No fix listed |
| debian/epiphany-browser(Debian:13) | = 51~rc-1 | No fix listed |
| debian/epiphany-browser(Debian:14) | All versions | No fix listed |
| debian/epiphany-browser(Debian:14) | = 48.3-2 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 48.5-1 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 48.5-2 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 48.5-3 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 49.0-1 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 49.1-1 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 49.2-1 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 49.2-2 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 49.2-3 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 50.3-1 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 50.3-2 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 50.4-1 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 50.4-2 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 51.0-1 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 51.1-1 | No fix listed |
| debian/epiphany-browser(Debian:14) | = 51~rc-1 | No fix listed |
| debian/erlang(Debian:12) | < 1:17.3-dfsg-3 | 1:17.3-dfsg-3 |
| debian/erlang(Debian:13) | < 1:17.3-dfsg-3 | 1:17.3-dfsg-3 |
| debian/erlang(Debian:14) | < 1:17.3-dfsg-3 | 1:17.3-dfsg-3 |
| debian/gnutls28(Debian:12) | < 3.3.8-5 | 3.3.8-5 |
| debian/gnutls28(Debian:13) | < 3.3.8-5 | 3.3.8-5 |
| debian/gnutls28(Debian:14) | < 3.3.8-5 | 3.3.8-5 |
| debian/haskell-tls(Debian:12) | < 1.2.9-2 | 1.2.9-2 |
| debian/haskell-tls(Debian:13) | < 1.2.9-2 | 1.2.9-2 |
| debian/haskell-tls(Debian:14) | < 1.2.9-2 | 1.2.9-2 |
| debian/lighttpd(Debian:12) | < 1.4.35-4 | 1.4.35-4 |
| debian/lighttpd(Debian:13) | < 1.4.35-4 | 1.4.35-4 |
| debian/lighttpd(Debian:14) | < 1.4.35-4 | 1.4.35-4 |
| debian/netsurf(Debian:12) | < 3.6-1 | 3.6-1 |
| debian/netsurf(Debian:13) | < 3.6-1 | 3.6-1 |
| debian/netsurf(Debian:14) | < 3.6-1 | 3.6-1 |
| debian/nss(Debian:12) | < 2:3.17.1-1 | 2:3.17.1-1 |
| debian/nss(Debian:13) | < 2:3.17.1-1 | 2:3.17.1-1 |
| debian/nss(Debian:14) | < 2:3.17.1-1 | 2:3.17.1-1 |
| debian/openssl(Debian:12) | < 1.0.1j-1 | 1.0.1j-1 |
| debian/openssl(Debian:13) | < 1.0.1j-1 | 1.0.1j-1 |
| debian/openssl(Debian:14) | < 1.0.1j-1 | 1.0.1j-1 |
| debian/pound(Debian:13) | < 2.6-6 | 2.6-6 |
| debian/pound(Debian:14) | < 2.6-6 | 2.6-6 |
| debian/surf(Debian:12) | All versions | No fix listed |
| debian/surf(Debian:12) | = 2.1+git20221016-4 | No fix listed |
| debian/surf(Debian:12) | = 2.1+git20221016-5 | No fix listed |
| debian/surf(Debian:12) | = 2.1+git20221016-6 | No fix listed |
| debian/surf(Debian:12) | = 2.1+git20240324-1 | No fix listed |
| debian/surf(Debian:12) | = 2.1+git20250419-1 | No fix listed |
| debian/surf(Debian:12) | = 2.1+git20250419-2 | No fix listed |
| debian/surf(Debian:13) | All versions | No fix listed |
| debian/surf(Debian:13) | = 2.1+git20250419-1 | No fix listed |
| debian/surf(Debian:13) | = 2.1+git20250419-2 | No fix listed |
| debian/surf(Debian:14) | All versions | No fix listed |
| debian/surf(Debian:14) | = 2.1+git20250419-1 | No fix listed |
| debian/surf(Debian:14) | = 2.1+git20250419-2 | No fix listed |
| debian/wolfssl(Debian:12) | < 3.4.8+dfsg-1 | 3.4.8+dfsg-1 |
| debian/wolfssl(Debian:13) | < 3.4.8+dfsg-1 | 3.4.8+dfsg-1 |
| redhat enterprise linux | = 5 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux desktop supplementary | = 5.0 | No fix listed |
| redhat enterprise linux desktop supplementary | = 6.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server supplementary | = 5.0 | No fix listed |
| redhat enterprise linux server supplementary | = 6.0 | No fix listed |
| redhat enterprise linux server supplementary | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| redhat enterprise linux workstation supplementary | = 6.0 | No fix listed |
| redhat enterprise linux workstation supplementary | = 7.0 | No fix listed |
| ibm aix | = 5.3 | No fix listed |
| ibm aix | = 6.1 | No fix listed |
| ibm aix | = 7.1 | No fix listed |
| apple mac os x | <= 10.10.1 | No fix listed |
| mageia | = 3.0 | No fix listed |
| mageia | = 4.0 | No fix listed |
| novell suse linux enterprise desktop | = 9.0 | No fix listed |
| novell suse linux enterprise desktop | = 10.0 | No fix listed |
| novell suse linux enterprise desktop | = 11.0 | No fix listed |
| novell suse linux enterprise desktop | = 12.0 | No fix listed |
| novell suse linux enterprise software development kit | = 11.0-sp3 | No fix listed |
| novell suse linux enterprise software development kit | = 12.0 | No fix listed |
| novell suse linux enterprise server | = 11.0-sp3 | No fix listed |
| novell suse linux enterprise server | = 12.0 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| fedoraproject fedora | = 19 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| OpenSSL | = 0.9.8 | No fix listed |
| OpenSSL | = 0.9.8a | No fix listed |
| OpenSSL | = 0.9.8b | No fix listed |
| OpenSSL | = 0.9.8c | No fix listed |
| OpenSSL | = 0.9.8d | No fix listed |
| OpenSSL | = 0.9.8e | No fix listed |
| OpenSSL | = 0.9.8f | No fix listed |
| OpenSSL | = 0.9.8g | No fix listed |
| OpenSSL | = 0.9.8h | No fix listed |
| OpenSSL | = 0.9.8i | No fix listed |
| OpenSSL | = 0.9.8j | No fix listed |
| OpenSSL | = 0.9.8k | No fix listed |
| OpenSSL | = 0.9.8l | No fix listed |
| OpenSSL | = 0.9.8m | No fix listed |
| OpenSSL | = 0.9.8m-beta1 | No fix listed |
| OpenSSL | = 0.9.8n | No fix listed |
| OpenSSL | = 0.9.8o | No fix listed |
| OpenSSL | = 0.9.8p | No fix listed |
| OpenSSL | = 0.9.8q | No fix listed |
| OpenSSL | = 0.9.8r | No fix listed |
| OpenSSL | = 0.9.8s | No fix listed |
| OpenSSL | = 0.9.8t | No fix listed |
| OpenSSL | = 0.9.8u | No fix listed |
| OpenSSL | = 0.9.8v | No fix listed |
| OpenSSL | = 0.9.8w | No fix listed |
| OpenSSL | = 0.9.8x | No fix listed |
| OpenSSL | = 0.9.8y | No fix listed |
| OpenSSL | = 0.9.8z | No fix listed |
| OpenSSL | = 0.9.8za | No fix listed |
| OpenSSL | = 0.9.8zb | No fix listed |
| OpenSSL | = 1.0.0 | No fix listed |
| OpenSSL | = 1.0.0-beta1 | No fix listed |
| OpenSSL | = 1.0.0-beta2 | No fix listed |
| OpenSSL | = 1.0.0-beta3 | No fix listed |
| OpenSSL | = 1.0.0-beta4 | No fix listed |
| OpenSSL | = 1.0.0-beta5 | No fix listed |
| OpenSSL | = 1.0.0a | No fix listed |
| OpenSSL | = 1.0.0b | No fix listed |
| OpenSSL | = 1.0.0c | No fix listed |
| OpenSSL | = 1.0.0d | No fix listed |
| OpenSSL | = 1.0.0e | No fix listed |
| OpenSSL | = 1.0.0f | No fix listed |
| OpenSSL | = 1.0.0g | No fix listed |
| OpenSSL | = 1.0.0h | No fix listed |
| OpenSSL | = 1.0.0i | No fix listed |
| OpenSSL | = 1.0.0j | No fix listed |
References
- Debian Security Tracker CVE-2014-3566 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- advisories.mageia.org third-party-advisory
- aix.software.ibm.com third-party-advisory
- APPLE-SA-2014-10-16-1 third-party-advisory vendor-advisory
- APPLE-SA-2014-10-16-3 third-party-advisory vendor-advisory
- askubuntu.com third-party-advisory
- blog.cryptographyengineering.com third-party-advisory
- blog.nodejs.org third-party-advisory
- blogs.technet.com third-party-advisory
- docs.ipswitch.com third-party-advisory
- downloads.asterisk.org third-party-advisory
- googleonlinesecurity.blogspot.com third-party-advisory
- HPSBUX03281 third-party-advisory vendor-advisory
- h20564.www2.hpe.com third-party-advisory
- kb.juniper.net third-party-advisory
- APPLE-SA-2015-01-27-4 mailing-list third-party-advisory vendor-advisory
- APPLE-SA-2015-09-16-2 mailing-list third-party-advisory vendor-advisory
- FEDORA-2014-12951 third-party-advisory vendor-advisory
- FEDORA-2014-13069 third-party-advisory vendor-advisory
- FEDORA-2014-13012 third-party-advisory vendor-advisory
- FEDORA-2015-9110 third-party-advisory vendor-advisory
- FEDORA-2015-9090 third-party-advisory vendor-advisory
- openSUSE-SU-2014:1331 third-party-advisory vendor-advisory
- SUSE-SU-2014:1357 third-party-advisory vendor-advisory
- SUSE-SU-2014:1361 third-party-advisory vendor-advisory
- SUSE-SU-2014:1526 third-party-advisory vendor-advisory
- SUSE-SU-2014:1549 third-party-advisory vendor-advisory
- openSUSE-SU-2015:0190 third-party-advisory vendor-advisory
- SUSE-SU-2015:0336 third-party-advisory vendor-advisory
- SUSE-SU-2015:0344 third-party-advisory vendor-advisory
- SUSE-SU-2015:0345 third-party-advisory vendor-advisory
- SUSE-SU-2015:0376 third-party-advisory vendor-advisory
- SUSE-SU-2015:0392 third-party-advisory vendor-advisory
- SUSE-SU-2015:0503 third-party-advisory vendor-advisory
- SUSE-SU-2015:0578 third-party-advisory vendor-advisory
- openSUSE-SU-2016:0640 third-party-advisory vendor-advisory
- SUSE-SU-2016:1457 third-party-advisory vendor-advisory
- SUSE-SU-2016:1459 third-party-advisory vendor-advisory
- HPSBMU03152 third-party-advisory vendor-advisory
- HPSBHF03156 third-party-advisory vendor-advisory
- HPSBUX03162 third-party-advisory vendor-advisory
- HPSBGN03191 third-party-advisory vendor-advisory
- HPSBMU03184 third-party-advisory vendor-advisory
- HPSBGN03164 third-party-advisory vendor-advisory
- HPSBGN03192 third-party-advisory vendor-advisory
- HPSBMU03183 third-party-advisory vendor-advisory
- HPSBMU03214 third-party-advisory vendor-advisory
- HPSBGN03201 third-party-advisory vendor-advisory
- HPSBGN03203 third-party-advisory vendor-advisory
- HPSBGN03202 third-party-advisory vendor-advisory
- HPSBGN03209 third-party-advisory vendor-advisory
- HPSBGN03205 third-party-advisory vendor-advisory
- HPSBGN03222 third-party-advisory vendor-advisory
- SSRT101838 third-party-advisory vendor-advisory
- SSRT101849 third-party-advisory vendor-advisory
- HPSBOV03227 third-party-advisory vendor-advisory
- SSRT101868 third-party-advisory vendor-advisory
- SSRT101854 third-party-advisory vendor-advisory
- SSRT101897 third-party-advisory vendor-advisory
- SSRT101898 third-party-advisory vendor-advisory
- SSRT101896 third-party-advisory vendor-advisory
- HPSBGN03251 third-party-advisory vendor-advisory
- HPSBGN03255 third-party-advisory vendor-advisory
- HPSBMU03260 third-party-advisory vendor-advisory
- SSRT101951 third-party-advisory vendor-advisory
- HPSBST03265 third-party-advisory vendor-advisory
- SSRT101968 third-party-advisory vendor-advisory
- HPSBMU03267 third-party-advisory vendor-advisory
- SSRT101922 third-party-advisory vendor-advisory
- HPSBMU03259 third-party-advisory vendor-advisory
- HPSBMU03283 third-party-advisory vendor-advisory
- SSRT101921 third-party-advisory vendor-advisory
- SSRT101846 third-party-advisory vendor-advisory
- HPSBMU03301 third-party-advisory vendor-advisory
- SSRT101790 third-party-advisory vendor-advisory
- SSRT101795 third-party-advisory vendor-advisory
- HPSBMU03304 third-party-advisory vendor-advisory
- HPSBHF03300 third-party-advisory vendor-advisory
- HPSBST03195 third-party-advisory vendor-advisory
- HPSBGN03305 third-party-advisory vendor-advisory
- HPSBMU03241 third-party-advisory vendor-advisory
- HPSBUX03194 third-party-advisory vendor-advisory
- HPSBGN03332 third-party-advisory vendor-advisory
- HPSBMU03263 third-party-advisory vendor-advisory
- HPSBMU03261 third-party-advisory vendor-advisory
- HPSBMU03223 third-party-advisory vendor-advisory
- HPSBPI03107 third-party-advisory vendor-advisory
- HPSBPI03360 third-party-advisory vendor-advisory
- HPSBMU03234 third-party-advisory vendor-advisory
- HPSBMU03416 third-party-advisory vendor-advisory
- HPSBST03418 third-party-advisory vendor-advisory
- HPSBGN03391 third-party-advisory vendor-advisory
- HPSBGN03569 third-party-advisory vendor-advisory
- [openssl-dev] 20141014 Patch to mitigate CVE-2014-3566 ("POODLE") mailing-list third-party-advisory
- people.canonical.com third-party-advisory