cyfenced.com →

[ CVE-2014-0160 · Published 7 Apr 2014 ]

OpenSSL Information Disclosure Vulnerability

Exploited · CISA KEV CVSS 7.5 EPSS 100%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-04
  • EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

CISA: The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 25 May 2022): Apply updates per vendor instructions.

[ References ]References