CVE-2014-0626: Medium severity Dell BSAFE SSL-J vulnerability
The (1) JSAFE and (2) JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and unauthenticated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0626?
CVE-2014-0626 has a high severity rating due to its potential to allow remote attackers to bypass cryptographic protections.
How do I fix CVE-2014-0626?
To fix CVE-2014-0626, upgrade to EMC RSA BSAFE SSL-J version 5.1.3 or later, or version 6.0.2 or later.
Which versions of EMC RSA BSAFE SSL-J are affected by CVE-2014-0626?
Affected versions of EMC RSA BSAFE SSL-J include 5.0, 5.1.0, 5.1.1, 5.1.2, 6.0, and 6.0.1.
What type of attack is CVE-2014-0626 vulnerable to?
CVE-2014-0626 is vulnerable to cryptographic protection bypass attacks during the TLS handshake.
Is there a workaround for CVE-2014-0626 if I cannot immediately upgrade?
There is no official workaround for CVE-2014-0626, so upgrading to fixed versions is strongly recommended.