Is CVE-2014-0224 being actively exploited?

CVE-2014-0224 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2014-0224?

CVE-2014-0224 has a CVSS 3.1 base score of 7.4 (HIGH).

CVE-2014-0224

HIGH · CVSS 7.4EPSS 95.3%EU EUVD

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Key facts

CVSS score: 7.4 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-326
EPSS score: 95.3% (100th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2014-0267)
Published: June 5, 2014
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2014-0267 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.

View on the EU Vulnerability Database

Affected products

fedoraproject / fedora
fedoraproject / fedora
filezilla-project / filezilla server
mariadb / mariadb
nodejs / node.js
openssl / openssl
opensuse / opensuse
opensuse / opensuse
python / python
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise web platform
redhat / jboss enterprise web server
redhat / storage
siemens / application processing engine
siemens / application processing engine firmware
siemens / cp1543-1
siemens / cp1543-1 firmware
siemens / rox
siemens / rox firmware
siemens / s7-1500
siemens / s7-1500 firmware

Certified products that may be affected

9 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 5 OpenSSH-Server Cryptographic Module - Red Hat®, Inc. - FIPS 140 1384 - historical
Red Hat Enterprise Linux 5 OpenSSH Client Cryptographic Module - Red Hat®, Inc. - FIPS 140 1385 - historical
Red Hat Enterprise Linux 5 OpenSwan Cryptographic Module - Red Hat®, Inc. - FIPS 140 1386 - historical
Red Hat Enterprise Linux 5 Kernel Crypto API Cryptographic Module - Red Hat®, Inc. - FIPS 140 1387 - historical
Red Hat Enterprise Linux 5 OpenSSL Cryptographic Module - Red Hat®, Inc. - FIPS 140 1320 - historical

See all 9 in the Security Certifications Explorer.

References

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc(Third Party Advisory)
http://ccsinjection.lepidum.co.jp(Third Party Advisory)
http://dev.mysql.com/doc/relnotes/workbench/en/wb-news-6-1-7.html(Third Party Advisory)
http://esupport.trendmicro.com/solution/en-US/1103813.aspx(Third Party Advisory)
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629(Not Applicable)
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29195(Not Applicable)
http://kb.juniper.net/InfoCenter/index?page=content&id=KB29217(Third Party Advisory)
http://linux.oracle.com/errata/ELSA-2014-1053.html(Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html(Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-updates/2015-02/msg00030.html(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140266410314613&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140317760000786&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140369637402535&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140386311427810&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140389274407904&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140389355508263&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140431828824371&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140448122410568&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140482916501310&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140491231331543&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140499864129699&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140544599631400&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140604261522465&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140621259019789&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140672208601650&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140752315422991&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140784085708882&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140794476212181&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140852757108392&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140852826008699&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140870499402361&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140904544427729&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=140983229106599&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=141025641601169&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=141147110427269&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=141164638606214&w=2(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain