CVE-2014-3566

Description

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

How to fix CVE-2014-3566

To remediate CVE-2014-3566, upgrade the affected package to a fixed version below.

• Debian/epiphany-browser—no fix listed
• —upgrade to 1:17.3-dfsg-3 or later
• —upgrade to 3.3.8-5 or later
• —upgrade to 1.2.9-2 or later
• —upgrade to 1.4.28-2+squeeze1.7 or later
• —upgrade to 1.4.31-4+deb7u4 or later
• —upgrade to 1.4.35-4 or later
• —no fix listed
• —upgrade to 3.6-1 or later
• —upgrade to 2:3.17.1-1 or later
• —upgrade to 6b34-1.13.6-1~deb7u1 or later
• —upgrade to 6b34-1.13.6-1~deb6u1 or later
• —upgrade to 7u75-2.5.4-1~deb7u1 or later
• —upgrade to 1.0.1j-1 or later
• —upgrade to 2.6-6 or later
• —no fix listed
• —upgrade to 3.4.8+dfsg-1 or later

Is CVE-2014-3566 being exploited?

Likely — EPSS is 93.5%, placing CVE-2014-3566 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (17)

• from 0
• from 0, < 1:17.3-dfsg-3
• from 0, < 3.3.8-5
• from 0, < 1.2.9-2
• from 0, < 1.4.28-2+squeeze1.7
• from 0, < 1.4.31-4+deb7u4
• from 0, < 1.4.35-4
• from 0
• from 0, < 3.6-1
• from 0, < 2:3.17.1-1
• from 0, < 6b34-1.13.6-1~deb7u1

CVSS scores

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-3566