Homepage

Cryptographic Issues The advisory has been revoked - it doesn't affect any version of package openssl  (opens in a new tab)

Threat Intelligence

EPSS
6.57% (93rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1404-OPENSSL-374359
  • published9 Jan 2015
  • disclosed9 Jan 2015
Report a new vulnerability Found a mistake?

Introduced: 9 Jan 2015

CVE-2014-3572  (opens in a new tab)
CWE-310  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:14.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu.

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.

References