OpenSSL CVE-2014-3572 Weak Encryption Vulnerability

Description

Severity: LowAn OpenSSL client will accept a handshake using an ephemeral ECDH ciphersuiteusing an ECDSA certificate if the server key exchange message is omitted. Thiseffectively removes forward secrecy from the ciphersuite.This issue affects all current OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.OpenSSL 1.0.1 users should upgrade to 1.0.1k.OpenSSL 1.0.0 users should upgrade to 1.0.0p.OpenSSL 0.9.8 users should upgrade to 0.9.8zd.This issue was reported to OpenSSL on 22nd October 2014 by KarthikeyanBhargavan of the PROSECCO team at INRIA. The fix was developed by StephenHenson of the OpenSSL core team.

Affected Applications

OpenSSL

CVE References

Other References