CVE-2014-0160

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 100,0%

Kerentanan Out-of-bounds Read pada openssl, filezilla-project filezilla server +26 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 4 Mei 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Rincian

Terbit di NVD

7 April 2014

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

OpenSSL Information Disclosure Vulnerability

Masuk KEV

4 Mei 2022

Tenggat CISA

25 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openssl.org/news/secadv_20140407.txt broken link · advisory vendor
• http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html patch · advisory pihak ketiga
• http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html patch · advisory pihak ketiga
• https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.... mailing list · patch · advisory pihak ketiga
• https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.... mailing list · patch · advisory pihak ketiga
• https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat... mailing list · patch · advisory pihak ketiga
• https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat... mailing list · patch · advisory pihak ketiga
• http://www.kb.cert.org/vuls/id/720951 advisory pihak ketiga · pemerintah AS
• http://www.us-cert.gov/ncas/alerts/TA14-098A advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0160 pemerintah AS
• http://advisories.mageia.org/MGASA-2014-0165.html advisory pihak ketiga
• http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/ issue tracking · advisory pihak ketiga
• http://heartbleed.com/ advisory pihak ketiga
• http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.html broken link · advisory pihak ketiga
• http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.html broken link · advisory pihak ketiga
• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00005.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-updates/2014-04/msg00061.html mailing list · advisory pihak ketiga
• http://marc.info/?l=bugtraq&m=139722163017074&w=2 mailing list · advisory pihak ketiga
• http://marc.info/?l=bugtraq&m=139757726426985&w=2 mailing list · advisory pihak ketiga
• http://marc.info/?l=bugtraq&m=139757819327350&w=2 mailing list · advisory pihak ketiga
• http://marc.info/?l=bugtraq&m=139757919027752&w=2 mailing list · advisory pihak ketiga
• http://marc.info/?l=bugtraq&m=139758572430452&w=2 mailing list · advisory pihak ketiga
• http://marc.info/?l=bugtraq&m=139765756720506&w=2 mailing list · advisory pihak ketiga