Log in Start free

Actively exploited · Published Apr 7, 2014 · Assigned by redhat

CVE-2014-0160

High 7.5 Exploited

In plain English

A high-severity out-of-bounds read in OpenSSL from OpenSSL. Attackers are actively exploiting it in the wild (listed by CISA on May 4, 2022). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)100.0%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since May 4, 2022
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 25, 2022.

Official description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12openssl1.0.1g-1DEBIAN-CVE-2014-0160
Debian:13openssl1.0.1g-1DEBIAN-CVE-2014-0160
Debian:14openssl1.0.1g-1DEBIAN-CVE-2014-0160

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References