CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
99.9%
The OpenSSL Project reports:
An attacker using a carefully crafted handshake can force
the use of weak keying material in OpenSSL SSL/TLS clients
and servers. This can be exploited by a Man-in-the-middle
(MITM) attack where the attacker can decrypt and modify
traffic from the attacked client and server. [CVE-2014-0224]
By sending an invalid DTLS handshake to an OpenSSL DTLS
client the code can be made to recurse eventually crashing
in a DoS attack. [CVE-2014-0221]
A buffer overrun attack can be triggered by sending invalid
DTLS fragments to an OpenSSL DTLS client or server. This is
potentially exploitable to run arbitrary code on a vulnerable
client or server. [CVE-2014-0195]
OpenSSL TLS clients enabling anonymous ECDH ciphersuites are
subject to a denial of service attack. [CVE-2014-3470]
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
99.9%