CVE-2014-3572: Medium severity openssl vulnerability
The ssl3getkeyexchange function in s3clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3572?
CVE-2014-3572 has a high severity rating due to its potential to compromise forward secrecy in SSL connections.
How do I fix CVE-2014-3572?
To fix CVE-2014-3572, upgrade your OpenSSL version to at least 0.9.8zd, 1.0.0p, or 1.0.1k or later.
Which versions of OpenSSL are affected by CVE-2014-3572?
CVE-2014-3572 affects OpenSSL versions prior to 0.9.8zd, 1.0.0p, and 1.0.1k.
What kind of attacks can CVE-2014-3572 enable?
CVE-2014-3572 can enable remote attackers to conduct ECDHE-to-ECDH downgrade attacks.
What impact does CVE-2014-3572 have on security?
The impact of CVE-2014-3572 is that it leads to a loss of forward secrecy, making encrypted communications more vulnerable.