CVE-2014-3566
LOW3.4EPSS 93.5%lighttpd - security update
發布日:2014/10/15修改日:2026/4/28
描述
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
受影響套件(17)
- Debian/epiphany-browserfrom 0
- Debian/erlangfrom 0, < 1:17.3-dfsg-3
- Debian/gnutls28from 0, < 3.3.8-5
- Debian/haskell-tlsfrom 0, < 1.2.9-2
- Debian/lighttpdfrom 0, < 1.4.28-2+squeeze1.7
- Debian/lighttpdfrom 0, < 1.4.31-4+deb7u4
- Debian/lighttpdfrom 0, < 1.4.35-4
- Debian/midorifrom 0
- Debian/netsurffrom 0, < 3.6-1
- Debian/nssfrom 0, < 2:3.17.1-1
- Debian/openjdk-6from 0, < 6b34-1.13.6-1~deb7u1
- Debian/openjdk-6from 0, < 6b34-1.13.6-1~deb6u1
- Debian/openjdk-7from 0, < 7u75-2.5.4-1~deb7u1
- Debian/opensslfrom 0, < 1.0.1j-1
- Debian/poundfrom 0, < 2.6-6
- Debian/surffrom 0
- Debian/wolfsslfrom 0, < 3.4.8+dfsg-1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | LOW3.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N |