CVE-2014-3566

原文の説明

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

影響を受けるソフトウェア

• OpenSSL = 0.9.8z= 0.9.8a= 0.9.8r= 0.9.8n= 0.9.8d= 0.9.8o 完全一致

詳細

公開日

2014-10-15

最終更新

2026-06-17

CVSS ベクター

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

CWE

CWE-310, CWE-329

参考資料

• cve.org/CVE-2014-3566
• nvd.nist.gov/vuln/detail/CVE-2014-3566
• advisories.mageia.org/MGASA-2014-0416.html
• aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc
• archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
• archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
• askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-20...
• blog.cryptographyengineering.com/2014/10/attack-of-week-poodle.html
• blog.nodejs.org/2014/10/23/node-v0-10-33-stable/
• blogs.technet.com/b/msrc/archive/2014/10/14/security-advisory-3009008-released.aspx
• docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf
• downloads.asterisk.org/pub/security/AST-2014-011.html
• googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html