CVE-2014-3511

Description

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a protocol downgrade issue.

Risk Information

Base Score

5.9

MODERATE

Vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

5.418

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities fixed in OpenSSL (x64) 1.0.1i	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.1	Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2	Windows
CVE-2014-3511	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234