CVE-2014-3511: Medium severity openssl vulnerability
By pathologically modifying a clients ClientHello message with fragmentation, it's possible to cause the server to negotiate TLS 1.0 instead of a higher version, even if both client and server support a higher protocol version.
Other sources
The ssl23getclienthello function in s23srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3511?
CVE-2014-3511 is considered to have moderate severity due to its impact on TLS negotiation.
How do I fix CVE-2014-3511?
To fix CVE-2014-3511, upgrade OpenSSL to a version later than 1.0.1.
What versions of OpenSSL are affected by CVE-2014-3511?
CVE-2014-3511 affects OpenSSL versions 1.0.0 through 1.0.1 inclusive.
What type of attack does CVE-2014-3511 involve?
CVE-2014-3511 involves a manipulation of the ClientHello message which can lead to a downgrade in the expected TLS version.
Is CVE-2014-3511 a client-side or server-side vulnerability?
CVE-2014-3511 is primarily a server-side vulnerability affecting the handling of ClientHello messages.