What’s Vulnerable › Vulnerabilities
CVE-2014-3566
- Severity: low (CVSS 3.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 100.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2014-10-15 · updated 2026-06-17
- Weakness: CWE-310
Description
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
Affected products
- macOS: through 10.10.1
- Debian Linux: 7.0, 8.0
- Fedoraproject Fedora: 19, 20, 21
- IBM AIX: 5.3, 6.1, 7.1
- IBM VIOS: 2.2.0.10, 2.2.0.11, 2.2.0.12, 2.2.0.13, 2.2.1.0, 2.2.1.1 (+18)
- Mageia: 3.0, 4.0
- Netbsd: 5.1, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.2 (+16)
- Novell Suse Linux Enterprise Desktop: 9.0, 10.0, 11.0, 12.0
- Novell Suse Linux Enterprise Server: 11.0-sp3, 12.0
- Novell Suse Linux Enterprise Software Development Kit: 11.0-sp3, 12.0
- OpenSSL: 0.9.8, 0.9.8a, 0.9.8b, 0.9.8c, 0.9.8d, 0.9.8e (+57)
- Opensuse: 12.3, 13.1
- Oracle Database: 11.2.0.4, 12.1.0.2
- Red Hat Enterprise Linux: 5
- RedHat Enterprise Linux Desktop: 6.0, 7.0
- RedHat Enterprise Linux Desktop Supplementary: 5.0, 6.0
- RedHat Enterprise Linux Server: 6.0, 7.0
- RedHat Enterprise Linux Server Supplementary: 5.0, 6.0, 7.0
- RedHat Enterprise Linux Workstation: 6.0, 7.0
- RedHat Enterprise Linux Workstation Supplementary: 6.0, 7.0
References
- http://advisories.mageia.org/MGASA-2014-0416.html
- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
- http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566
- http://blog.cryptographyengineering.com/2014/10/attack-of-week-poodle.html
- http://blog.nodejs.org/2014/10/23/node-v0-10-33-stable/
- http://blogs.technet.com/b/msrc/archive/2014/10/14/security-advisory-3009008-released.aspx
- http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf
- http://downloads.asterisk.org/pub/security/AST-2014-011.html
- http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html
Get alerted when CVE-2014-3566 or the next vulnerability affects your stack