open-source-dependency-vulnerabilitywidely-deployed-product-advisoryend-of-life-software

OpenSSL Flaws Expose IBM and HP Products to Traffic Interception, Code Execution and Crashes

Vulnerability Disclosure · 61 sources · Updated 5d ago · First seen Aug 25, 2014

Seven OpenSSL vulnerabilities disclosed in 2014 prompted security updates across IBM and HP enterprise products. The flaws can enable man-in-the-middle attacks, arbitrary code execution, denial of service, cross-session data injection and cryptographic information disclosure, depending on configuration. CVE-2014-0224 allows an attacker between a vulnerable client and server to force weak keying material and decrypt or modify traffic; CVE-2014-0195 involves malformed DTLS fragments that can trigger a buffer overflow and potentially execute code. CVE-2014-3470 can crash clients using anonymous ECDH cipher suites, while CVE-2014-0198 can crash applications with buffer-release mode enabled. OpenSSL designated 0.9.8za, 1.0.0m and 1.0.1h as the corresponding fixed branch releases, with applicability varying by flaw.

Remediation requires product-specific updates, including bundled components. IBM issued fixes for IBM i, Security Access Manager appliances, Sterling Connect:Express for UNIX and Tivoli Management Framework, and identified IBM SDK for Node.js 1.1.0.4 as the remediation for affected SDK releases, including the Cordova tools in Rational Application Developer. For SmartCloud Orchestrator 2.3 and 2.3 Fix Pack 1, exposure is limited to an optional Windows enablement bundle that IBM recommends removing because supported functions do not require it. IBM i V5R3 and V5R4 received no fixes and require migration. HP released System Management Homepage 7.3.3.1, Smart Update Manager 6.4.1, Version Control Agent 7.3.3 and Version Control Repository Manager 7.3.4, alongside Systems Insight Manager hotfixes and Insight Control component updates. Upgrading Insight Control to 7.3.1 alone does not resolve all covered flaws; HP also warned that Linux x86 System Management Homepage 7.3.3.1 retained OpenSSL 1.0.0d, making protection against CVE-2014-0224 dependent on upgrading communicating products.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

47 events · Mar 25, 2014 – Nov 20, 2014

Reported Sep 23, 20262mo ago
Red Hat releases OpenSSL security updates for Enterprise Linux 7
Red Hat released RHSA-2014:0679 with backported fixes for six OpenSSL vulnerabilities affecting Enterprise Linux 7, rating the update Important. Administrators were advised to upgrade and restart all OpenSSL-linked services or reboot to activate the fixes.
RHSA-2014:0679 - Security Advisory - Red Hat 客户门户网站
Reported Jun 20, 20215y ago
Novell addresses OpenSSL advisory for Open Enterprise Server 2 SP3
Novell published a support advisory addressing the June 5, 2014 OpenSSL security advisory in relation to Open Enterprise Server 2 SP3.
OpenSSL Security Advisory (05 June 2014) and Open Enterprise Server 2 SP3.
Reported Jun 20, 20215y ago
Novell addresses OpenSSL advisory for Open Enterprise Server 11 SP1
Novell published a support advisory addressing the June 5, 2014 OpenSSL security advisory in relation to Open Enterprise Server 11 SP1.
OpenSSL Security Advisory (05 June 2014) and Open Enterprise Server 11 SP1.
Reported Oct 7, 201610y ago
HPE discloses OpenSSL and OpenSSH vulnerabilities in StoreVirtual products
HPE bulletin HPSBST03642 revision 3 identifies OpenSSL and OpenSSH vulnerabilities affecting StoreVirtual products running LeftHand OS. Listed impacts include remote arbitrary code execution, denial of service, disclosure of sensitive information, and unauthorized access.
HPSBST03642 rev.3 - HPE StoreVirtual Products running LeftHand OS using OpenSSL and OpenSSH, Remote Arbitrary Code Execution, Denial of Service (DoS), Disclosure of Sensitive Information, Unauthorized Access
Reported Sep 1, 201511y ago
IBM discloses OpenSSL vulnerabilities and fixes for Tivoli Workload Scheduler
IBM identified four OpenSSL vulnerabilities affecting specified Tivoli Workload Scheduler Distributed releases from 8.4.0 through 9.2.0 and certain agent configurations, potentially enabling traffic decryption or modification, denial of service, or arbitrary code execution. IBM provided fixes under APAR IV61392 and listed no workarounds or mitigations.
Security Bulletin: Tivoli Workload Scheduler is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-3470
Reported Jun 23, 201511y ago
IBM advises removing vulnerable SmartCloud Orchestrator Windows enablement bundle
IBM identified seven OpenSSL vulnerabilities affecting SmartCloud Orchestrator 2.3 and 2.3 Fix Pack 1 through the Image Construction and Composition Tool's Enablement Bundle for Virtual Applications and System Plugins on Windows. IBM recommended removing the bundle because it is unnecessary for officially supported functions.
Security Bulletin: SmartCloud Orchestrator is affected by the following OpenSSL vulnerabilities (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470, CVE-2014-0076)
Nov 20, 201412y ago
HP revises OpenSSL network-product advisory and affected-device scope
HP revised HPSBHF03052 to remove iMC Platform, the 5900 virtual switch, and Router 8800 products after determining they were not vulnerable, while adding other affected products. The bulletin lists product-specific fixes for affected HP, H3C, and 3Com networking products; fixes for HP 1810v1 switches and M220 access points remained in progress.
'[security bulletin] HPSBHF03052 rev.2 - HP Network Products running OpenSSL, Multiple Remote Vulnera' - MARC
Aug 25, 201412y ago
HP announces Systems Insight Manager 7.2 hotfix availability
Revision 2 of HPSBMU03076 announced availability of the Systems Insight Manager 7.2 hotfix kit. HP stated that applying the SIM hotfix kits does not require a system reboot.
'[security bulletin] HPSBMU03076 rev.2 - HP Systems Insight Manager (SIM) on Linux and Windows runnin' - MARC
Aug 8, 201412y ago
HP publishes Insight Control server deployment remediation procedures
HP disclosed seven OpenSSL vulnerabilities in components bundled with Insight Control server deployment versions 7.1.2, 7.2.0, 7.2.1, 7.2.2, and 7.3.1. It provided component-replacement procedures and warned that 7.2.2 users must upgrade to 7.3.1 and then apply additional updates.
'[security bulletin] HPSBMU03062 rev.1 - HP Insight Control server deployment on Linux and Windows ru' - MARC
Jul 23, 201412y ago
HP discloses OpenSSL flaws and fix for Insight Control server migration
HP published bulletin HPSBMU03074 revision 1 covering seven OpenSSL vulnerabilities affecting Insight Control server migration 7.2.2, 7.3, 7.3.1, and 7.3.2 on Linux and Windows. HP provided version 7.3.3 as remediation, requiring users of 7.2.2 to upgrade to 7.3 first.
'[security bulletin] HPSBMU03074 rev.1 - HP Insight Control server migration on Linux and Windows run' - MARC
Jul 23, 201412y ago
HP discloses OpenSSL exposure in Systems Insight Manager
HP published bulletin HPSBMU03076 identifying seven vulnerabilities affecting Systems Insight Manager versions 7.2 through 7.3.1, including specified intermediate releases, on Linux and Windows. The bulletin also identifies affected bundled management components requiring separate remediation.
'[security bulletin] HPSBMU03076 rev.2 - HP Systems Insight Manager (SIM) on Linux and Windows runnin' - MARC
Jul 9, 201412y ago
HP discloses OpenSSL vulnerabilities and OneView 1.10 remediation
HP published bulletin HPSBGN03068 revision 1 identifying CVE-2010-5298, CVE-2014-0198, and CVE-2014-0224 in OneView versions 1.0, 1.01, and 1.05, potentially enabling remote denial of service, unauthorized access, or information disclosure. HP provided OneView 1.10 to resolve the vulnerabilities and directed existing users to upgrade through the Update Appliance feature.
'[security bulletin] HPSBGN03068 rev.1 - HP OneView running OpenSSL, Remote Denial of Service (DoS), ' - MARC
Jul 9, 201412y ago
HP discloses OpenSSL vulnerabilities and patches for Operations Orchestration
HP published bulletin HPSBMU03069 revision 1 identifying CVE-2014-0195, CVE-2014-0221, and CVE-2014-3470 in OpenSSL components embedded in Operations Orchestration v9.X. HP provided remediation guidelines and patches through its Software Support Online portal.
'[security bulletin] HPSBMU03069 rev.1 - HP Software Operation Orchestration, OpenSSL Vulnerability, ' - MARC
Jul 8, 201412y ago
HP discloses four OpenSSL vulnerabilities in Operations Analytics
HP issued bulletin HPSBMU03065 rev.1 identifying CVE-2014-0195, CVE-2014-0221, CVE-2014-0224, and CVE-2014-3470 in Operations Analytics 2.0 and 2.1. HP directed affected customers to support document KM01020441 for remediation guidance without specifying a fixed product version in the bulletin.
'[security bulletin] HPSBMU03065 rev.1 - HP Operations Analytics, OpenSSL Vulnerability, SSL/TLS, Rem' - MARC
Jul 7, 201412y ago
HP discloses five OpenSSL vulnerabilities and remediation for IceWall products
HP published bulletin HPSBGN03050 rev.1 identifying five OpenSSL vulnerabilities affecting IceWall SSO components and MCRP. HP provided bundled OpenSSL updates, directed RHEL and HP-UX deployments to platform patches, and described configuration-based mitigations where possible.
'[security bulletin] HPSBGN03050 rev.1 - HP IceWall SSO Dfw and HP IceWall MCRP running OpenSSL, Remo' - MARC
Jul 3, 201412y ago
IBM publishes SDK for Node.js OpenSSL security bulletin
IBM identified six OpenSSL vulnerabilities affecting SDK for Node.js 1.1.0.3 and earlier, with version 1.1.0.4 and later designated as fixed. Customers using a bundled SDK were directed to IBM support or the relevant product security bulletin.
Security Bulletin: IBM® SDK for Node.js™ is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470
Jul 3, 201412y ago
HP warns Linux x86 System Management Homepage update retains older OpenSSL
Revision 2 of HP's bulletin added a disclaimer that System Management Homepage 7.3.3.1 for Linux x86 still contains OpenSSL 1.0.0d. HP stated that protection against CVE-2014-0224 depends on upgrading all other products with which that installation communicates.
'[security bulletin] HPSBMU03051 rev.2 - HP System Management Homepage running OpenSSL on Linux and W' - MARC
Jul 1, 201412y ago
Splunk publishes OpenSSL advisory identifying fixed Enterprise releases
Splunk published an advisory identifying Enterprise versions 6.1.2, 6.0.5, and 5.0.9 as containing fixes for CVE-2014-0224 and CVE-2014-3470 across affected components, including indexers, search heads, and forwarders. Splunk recommended upgrading and stated that it was unaware of active exploitation of either vulnerability.
SP-CAAAM2D | Splunk Vulnerability Disclosure
Jul 1, 201412y ago
HP publishes Smart Update Manager bulletin identifying version 6.4.1 as the fix
HP disclosed six OpenSSL vulnerabilities affecting Smart Update Manager versions 6.0.0 through 6.4.0. The bulletin identifies HP SUM 6.4.1 as the update resolving the listed vulnerabilities.
'[security bulletin] HPSBMU03055 rev.1 - HP Smart Update Manager (HP SUM) running OpenSSL, Remote Den' - MARC
Jun 30, 201412y ago
IBM discloses four OpenSSL vulnerabilities in Sterling Connect:Express
IBM published a bulletin covering Sterling Connect:Express for UNIX releases in the 1.4.6, 1.5.0.9, and 1.5.0.11 branches. It identifies interim fixes 146-108, 150-906, and 150-1105 and reports no known workarounds.
Security Bulletin: IBM Sterling Connect:Express for UNIX is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470
Jun 27, 201412y ago
IBM discloses OpenSSL vulnerabilities and fixes for Initiate and InfoSphere MDM
IBM published a bulletin identifying seven OpenSSL vulnerabilities affecting Initiate Master Data Service and InfoSphere Master Data Management offerings through components including Master Data Engine, Message Brokers, and Enterprise Integrator Toolkit. IBM provided version-specific refresh packs and interim fixes through Fix Central and reported no known workarounds or mitigations.
Security Bulletin: IBM Initiate Master Data Service, IBM InfoSphere Master Data Management are affected by the following OpenSSL vulnerabilities: (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 and CVE-2014-0076)
Jun 27, 201412y ago
HP publishes Version Control Repository Manager remediation bulletin
HP disclosed seven OpenSSL vulnerabilities affecting Version Control Repository Manager 7.3.3 and earlier on Linux and Windows. The bulletin identifies VCRM 7.3.4.0 for Windows and 7.3.4-0 for Linux as the corrective updates.
'[security bulletin] HPSBMU03056 rev.1 - HP Version Control Repository Manager (HP VCRM) running Open' - MARC
Jun 27, 201412y ago
HP publishes Version Control Agent OpenSSL remediation bulletin
HP disclosed seven vulnerabilities affecting Version Control Agent 7.3.2 and earlier on Linux and Windows. The bulletin identifies VCA 7.3.3.0 for Windows and 7.3.3-0 for Linux as the corrective updates.
'[security bulletin] HPSBMU03057 rev.1 - HP Version Control Agent (HP VCA) running OpenSSL on Linux a' - MARC
Jun 24, 201412y ago
IBM discloses OpenSSL exposure and fixes for Rational ClearCase
IBM published a bulletin addressing CVE-2014-0224 and CVE-2014-3470 in selected SSL-enabled Rational ClearCase integrations and custom Perl scripts. It identifies ClearCase 8.0.1.4, 8.0.0.11, and 7.1.2.14 as corrective updates and recommends disabling affected integrations and custom SSL use until fixes are applied.
Security Bulletin: Rational ClearCase is affected by OpenSSL vulnerabilities (CVE-2014-0224, CVE-2014-3470, CVE-2015-0292)
Jun 23, 201412y ago
HP discloses OpenSSL vulnerabilities in System Management Homepage
HP published bulletin HPSBMU03051 covering seven vulnerabilities affecting System Management Homepage 7.3.2 and earlier on Linux and Windows. The bulletin identifies version 7.3.3.1 updates and version 7.2.4.1 specifically for Windows 2003 as remediation.
'[security bulletin] HPSBMU03051 rev.2 - HP System Management Homepage running OpenSSL on Linux and W' - MARC
Reported Jun 19, 201412y ago
IBM discloses OpenSSL vulnerabilities and fix for Tivoli Network Manager Perl Collector
IBM identified four OpenSSL vulnerabilities affecting HTTPS support for the Perl Collector installation in Tivoli Network Manager IP Edition 3.9 Fix Pack 4, potentially enabling man-in-the-middle attacks, denial of service, or arbitrary code execution. IBM directed customers to contact its service team and reference APAR IV61480 to obtain a fix.
Security Bulletin: IBM Tivoli Network Manager IP Edition V39 Fix Pack 4 HTTPS support for Perl Collector install is affected by the following OpenSSL vulnerabilities: (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195 and CVE-2014-3470)
Reported Jun 19, 201412y ago
IBM discloses OpenSSL exposure and patches for Security Access Manager appliances
IBM identified OpenSSL vulnerabilities affecting Security Access Manager for Mobile 8.0 and for Web 7.0 and 8.0. It provided patches under APAR IV59660 for all affected versions and listed no workarounds.
Security Bulletin: IBM Security Access Manager for Mobile and IBM Security Access Manager for Web appliances are affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 and possibly CVE-2014-0076
Jun 19, 201412y ago
IBM discloses OpenSSL vulnerabilities and interim fixes for Worklight
IBM disclosed three OpenSSL vulnerabilities affecting Worklight Consumer and Enterprise Editions 6.1.0.0 and 6.1.0 Fix Pack 1, enabling man-in-the-middle attacks, denial of service, or local ECDSA nonce recovery. IBM provided 6.1.0.1 interim fixes for both editions and listed no known workarounds or mitigations.
Security Bulletin: IBM Worklight is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-3470 and CVE-2014-0076
Jun 19, 201412y ago
IBM dates Node.js SDK 1.1.0.4 update packages for Rational Cordova tools
IBM listed downloads upgrading the SDK from 1.1.0.2 to 1.1.0.4 for Rational Application Developer 9.1 and 9.1.0.1. The critical update addresses six OpenSSL vulnerabilities in the SDK used by Cordova tools.
IBM SDK for Node.js 1.1.0.4 for use by the Cordova tools
Jun 19, 201412y ago
IBM publishes IBM i bulletin covering five OpenSSL vulnerabilities
IBM identified affected releases V5R3, V5R4, 6.1, 7.1, and 7.2, and listed PTFs SI53667, SI53666, and SI53663 for the supported releases. Unsupported V5R3 and V5R4 would not receive fixes, and IBM recommended upgrading them.
Security Bulletin: IBM i is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198 and CVE-2014-3470
Jun 18, 201412y ago
HP discloses five OpenSSL vulnerabilities and releases OpenVMS SSL update
HP issued bulletin HPSBOV03047 revision 1 covering five OpenSSL vulnerabilities affecting HP SSL version 1.4-471 or earlier for OpenVMS. HP made version 1.4-476 available to resolve the vulnerabilities and urged customers to apply the update promptly.
'[security bulletin] HPSBOV03047 rev.1 - HP OpenVMS running OpenSSL, Remote Denial of Service (DoS), ' - MARC
Jun 17, 201412y ago
IBM discloses OpenSSL exposure in Tivoli Management Framework
IBM published its original bulletin identifying seven OpenSSL vulnerabilities affecting Tivoli Management Framework 4.1.1 on linux-ix86 and linux-s390. The bulletin lists interim fixes 4.1.1-TMF-0139 and 4.1.1-TMF-0140 to upgrade affected components to OpenSSL 1.0.1h.
Security Bulletin: Tivoli Management Framework is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 and possibly CVE-2014-0076.
Jun 16, 201412y ago
IBM documents OpenSSL flaws and hotfixes for Security Network Protection
IBM created a bulletin identifying four OpenSSL vulnerabilities affecting Security Network Protection XGS 3100, 4100, and 5100 appliances running firmware 5.1, 5.1.1, 5.1.2, 5.1.2.1, or 5.2. The bulletin provided hotfixes for every affected version and identified disabling outbound SSL Inspection as a workaround.
Security Bulletin: IBM Security Network Protection is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470
Jun 16, 201412y ago
IBM discloses OpenSSL vulnerabilities and fixes for Tivoli Netcool monitors
IBM disclosed four OpenSSL vulnerabilities affecting Tivoli Netcool System Service Monitors/Application Service Monitors 4.0.0 and 4.0.1 releases, potentially enabling man-in-the-middle attacks, denial of service, or arbitrary code execution. IBM recommended SSM 4.0.0.14 Interim Fix 03 or SSM 4.0.1.1 Interim Fix 02, as appropriate, and listed no known workarounds.
Security Bulletin: IBM Tivoli Netcool System Service Monitors/Application Service Monitors is affected by the following OpenSSL vulnerabilities: (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195 and CVE-2014-3470)
Jun 12, 201412y ago
HP discloses five OpenSSL vulnerabilities and updates for HP-UX
HP issued bulletin HPSBUX03046 revision 1 covering five OpenSSL vulnerabilities affecting HP-UX B.11.11, B.11.23, and B.11.31 running OpenSSL versions earlier than 0.9.8za. HP provided release-specific updates and instructed administrators to manually install OpenSSL A.00.09.08za or a subsequent version.
'[security bulletin] HPSBUX03046 SSRT101590 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (' - MARC
Jun 5, 201412y ago
Red Hat and Fedora release updates for OpenSSL CVE-2014-0198
Red Hat addressed the NULL pointer dereference vulnerability through RHSA-2014:0625 for Enterprise Linux 6 and RHSA-2014:0628 for Storage 2.1. Fedora also pushed openssl-1.0.1e-38 updates to the Fedora 19 and 20 stable repositories.
1093837 - (CVE-2014-0198) CVE-2014-0198 openssl: SSL_MODE_RELEASE_BUFFERS NULL pointer dereference in do_ssl3_write()
Jun 5, 201412y ago
Cisco discloses seven OpenSSL vulnerabilities affecting its products
Cisco published an advisory identifying exposure to seven OpenSSL vulnerabilities across multiple products acting as SSL/DTLS clients or terminating servers; devices merely forwarding traffic were not affected. Cisco announced plans for software updates and directed customers to product-specific bug records for impact, potential workarounds, and remediation details.
Multiple Vulnerabilities in OpenSSL Affecting Cisco Products
Jun 5, 201412y ago
OpenSSL publishes seven-vulnerability advisory and upgrade guidance
OpenSSL disclosed flaws enabling man-in-the-middle attacks, potential code execution, denial of service, cross-session data injection, and ECDSA nonce recovery. The advisory directed affected users to OpenSSL 0.9.8za, 1.0.0m, or 1.0.1h; the CVE-2014-3470 record was also published that day.
[no-title]
Jun 2, 201412y ago
OpenSSL notifies Red Hat and other OS distributions of CCS Injection vulnerability
The OpenSSL team contacted Red Hat and other operating-system distributions about CVE-2014-0224 ahead of public disclosure. The vulnerability could allow a man-in-the-middle attacker to decrypt or modify traffic between vulnerable OpenSSL clients and servers.
OpenSSL CCS Injection Vulnerability (CVE-2014-0224) Alert - Red Hat Customer Portal
May 28, 201412y ago
Anonymous ECDH client-crash vulnerability CVE-2014-3470 reported
Felix Gröbert and Ivan Fratrić of Google reported CVE-2014-3470 to OpenSSL. The flaw exposes TLS clients using anonymous ECDH cipher suites to denial of service.
[no-title]
May 9, 201413y ago
DTLS client recursion vulnerability CVE-2014-0221 reported
Imre Rad of Search-Lab reported CVE-2014-0221 to OpenSSL. An invalid DTLS handshake could trigger uncontrolled recursion and crash an application using OpenSSL as a DTLS client.
[no-title]
May 6, 201413y ago
CVE-2014-0198 record published for OpenSSL application-crash vulnerability
The CVE record disclosed improper buffer-pointer management in do_ssl3_write that could cause a NULL pointer dereference. Remote exploitation requires SSL_MODE_RELEASE_BUFFERS to be enabled.
CVE Record: CVE-2014-0198
May 1, 201413y ago
SSL/TLS handshake vulnerability CVE-2014-0224 reported through JPCERT/CC
KIKUCHI Masashi's finding was reported to OpenSSL through JPCERT/CC. An attacker between a vulnerable OpenSSL client and server could force weak keying material to decrypt or modify traffic.
[no-title]
Apr 23, 201413y ago
DTLS buffer overflow CVE-2014-0195 reported to OpenSSL
Jüri Aedla reported CVE-2014-0195 through HP ZDI. Malformed DTLS fragments could trigger a buffer overrun potentially allowing arbitrary code execution on affected DTLS clients or servers.
[no-title]
Apr 14, 201413y ago
CVE-2010-5298 record published for OpenSSL read-buffer race condition
The CVE record disclosed a race condition in OpenSSL through 1.0.1g affecting ssl3_read_bytes when SSL_MODE_RELEASE_BUFFERS is enabled in a multithreaded environment. Remote attackers could exploit an SSL connection to inject data across sessions or cause denial of service through use-after-free and parsing errors.
CVE Record: CVE-2010-5298
Apr 12, 201413y ago
OpenBSD issues security fix for OpenSSL read-buffer race condition
An OpenBSD 5.5 security fix and associated OpenSSL patch addressed the read-buffer race condition tracked as CVE-2010-5298. The flaw could allow cross-session data injection or denial of service when SSL_MODE_RELEASE_BUFFERS was enabled in a multithreaded environment.
CVE Record: CVE-2010-5298
Mar 25, 201413y ago
CVE-2014-0076 record published for OpenSSL ECDSA nonce side-channel flaw
The CVE record disclosed a cache side-channel vulnerability in OpenSSL's Montgomery ladder implementation through version 1.0.0l. Non-constant-time swap operations could help local users recover ECDSA nonces using a FLUSH+RELOAD attack.
CVE Record: CVE-2014-0076

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

7 linked

OpenSSL SSL_MODE_RELEASE_BUFFERS Cross-Session Injection and Denial of Service (CVE-2010-5298)OpenSSL DTLS Client Handshake Recursion Denial of Service (CVE-2014-0221)CCS Injection (CVE-2014-0224)OpenSSL DTLS Fragment Reassembly Buffer Overflow (CVE-2014-0195)OpenSSL Anonymous ECDH NULL Pointer Dereference Denial of Service (CVE-2014-3470)OpenSSL ECDSA Nonce Recovery via FLUSH+RELOAD (CVE-2014-0076)OpenSSL SSL_MODE_RELEASE_BUFFERS NULL Pointer Dereference Denial of Service (CVE-2014-0198)

Affected products

14 linked

Smartcloud OrchestratorIntelligent Management Center User Access ManagerIntelligent Management Center Endpoint Admission DefenseInitiate Master Data ServiceRational ClearcaseTivoli Netcool System Service MonitorsTivoli Netcool Application Service MonitorsSmartcloud ProvisioningTivoli Management FrameworkHp-Ux+4 more

Organizations

4 linked

3comInternational Business MachinesHewlett Packard EnterpriseH3C Technologies Co., Limited

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

50 references tracked. Mallory keeps watching after this page renders.

Ibm Xforce ExchangeNews · Oct 13, 2026

IBM X-Force ExchangeOpen source ↗

Ibm Xforce ExchangeNews · Oct 13, 2026

IBM X-Force ExchangeOpen source ↗

Ibm Xforce ExchangeNews · Oct 13, 2026

IBM X-Force ExchangeOpen source ↗

Ibm Xforce ExchangeNews · Oct 13, 2026

IBM X-Force ExchangeOpen source ↗

42 additional sources from 01-07-2014 to 23-09-2026

Marc InfoNews · Jun 27, 2014

'[security bulletin] HPSBMU03057 rev.1 - HP Version Control Agent (HP VCA) running OpenSSL on Linux a' - MARCOpen source ↗

Marc InfoNews · Jun 27, 2014

'[security bulletin] HPSBMU03056 rev.1 - HP Version Control Repository Manager (HP VCRM) running Open' - MARCOpen source ↗

IbmNews

IbmOpen source ↗

UnclassifiedNews

UnclassifiedOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

OpenSSL Flaws Expose IBM and HP Products to Traffic Interception, Code Execution and Crashes

Vulnerability Disclosure · 61 sources · Updated 5d ago · First seen Aug 25, 2014

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

OpenSSL Flaws Expose IBM and HP Products to Traffic Interception, Code Execution and Crashes

How this story unfolded

Red Hat releases OpenSSL security updates for Enterprise Linux 7

Novell addresses OpenSSL advisory for Open Enterprise Server 2 SP3

Novell addresses OpenSSL advisory for Open Enterprise Server 11 SP1

HPE discloses OpenSSL and OpenSSH vulnerabilities in StoreVirtual products

IBM discloses OpenSSL vulnerabilities and fixes for Tivoli Workload Scheduler

IBM advises removing vulnerable SmartCloud Orchestrator Windows enablement bundle

HP revises OpenSSL network-product advisory and affected-device scope

HP announces Systems Insight Manager 7.2 hotfix availability

HP publishes Insight Control server deployment remediation procedures

HP discloses OpenSSL flaws and fix for Insight Control server migration

HP discloses OpenSSL exposure in Systems Insight Manager

HP discloses OpenSSL vulnerabilities and OneView 1.10 remediation

HP discloses OpenSSL vulnerabilities and patches for Operations Orchestration

HP discloses four OpenSSL vulnerabilities in Operations Analytics

HP discloses five OpenSSL vulnerabilities and remediation for IceWall products

IBM publishes SDK for Node.js OpenSSL security bulletin

HP warns Linux x86 System Management Homepage update retains older OpenSSL

Splunk publishes OpenSSL advisory identifying fixed Enterprise releases

HP publishes Smart Update Manager bulletin identifying version 6.4.1 as the fix

IBM discloses four OpenSSL vulnerabilities in Sterling Connect:Express

IBM discloses OpenSSL vulnerabilities and fixes for Initiate and InfoSphere MDM

HP publishes Version Control Repository Manager remediation bulletin

HP publishes Version Control Agent OpenSSL remediation bulletin

IBM discloses OpenSSL exposure and fixes for Rational ClearCase

HP discloses OpenSSL vulnerabilities in System Management Homepage

IBM discloses OpenSSL vulnerabilities and fix for Tivoli Network Manager Perl Collector

IBM discloses OpenSSL exposure and patches for Security Access Manager appliances

IBM discloses OpenSSL vulnerabilities and interim fixes for Worklight

IBM dates Node.js SDK 1.1.0.4 update packages for Rational Cordova tools

IBM publishes IBM i bulletin covering five OpenSSL vulnerabilities

HP discloses five OpenSSL vulnerabilities and releases OpenVMS SSL update

IBM discloses OpenSSL exposure in Tivoli Management Framework

IBM documents OpenSSL flaws and hotfixes for Security Network Protection

IBM discloses OpenSSL vulnerabilities and fixes for Tivoli Netcool monitors

HP discloses five OpenSSL vulnerabilities and updates for HP-UX

Red Hat and Fedora release updates for OpenSSL CVE-2014-0198

Cisco discloses seven OpenSSL vulnerabilities affecting its products

OpenSSL publishes seven-vulnerability advisory and upgrade guidance

OpenSSL notifies Red Hat and other OS distributions of CCS Injection vulnerability

Anonymous ECDH client-crash vulnerability CVE-2014-3470 reported

DTLS client recursion vulnerability CVE-2014-0221 reported

CVE-2014-0198 record published for OpenSSL application-crash vulnerability

SSL/TLS handshake vulnerability CVE-2014-0224 reported through JPCERT/CC

DTLS buffer overflow CVE-2014-0195 reported to OpenSSL

CVE-2010-5298 record published for OpenSSL read-buffer race condition

OpenBSD issues security fix for OpenSSL read-buffer race condition

CVE-2014-0076 record published for OpenSSL ECDSA nonce side-channel flaw

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

OpenSSL DTLS Context Handling Flaw Can Cause Application Crashes

IBM Patches High-Severity Flaws in Langflow, Application Gateway, QRadar, and WebSphere

IBM Products Exposed to Multiple Security Flaws Including Guardium Command Execution

OpenSSL Flaws Expose IBM and HP Products to Traffic Interception, Code Execution and Crashes

How this story unfolded

Red Hat releases OpenSSL security updates for Enterprise Linux 7

Novell addresses OpenSSL advisory for Open Enterprise Server 2 SP3

Novell addresses OpenSSL advisory for Open Enterprise Server 11 SP1

HPE discloses OpenSSL and OpenSSH vulnerabilities in StoreVirtual products

IBM discloses OpenSSL vulnerabilities and fixes for Tivoli Workload Scheduler

IBM advises removing vulnerable SmartCloud Orchestrator Windows enablement bundle

HP revises OpenSSL network-product advisory and affected-device scope

HP announces Systems Insight Manager 7.2 hotfix availability

HP publishes Insight Control server deployment remediation procedures

HP discloses OpenSSL flaws and fix for Insight Control server migration

HP discloses OpenSSL exposure in Systems Insight Manager

HP discloses OpenSSL vulnerabilities and OneView 1.10 remediation

HP discloses OpenSSL vulnerabilities and patches for Operations Orchestration

HP discloses four OpenSSL vulnerabilities in Operations Analytics

HP discloses five OpenSSL vulnerabilities and remediation for IceWall products

IBM publishes SDK for Node.js OpenSSL security bulletin

HP warns Linux x86 System Management Homepage update retains older OpenSSL

Splunk publishes OpenSSL advisory identifying fixed Enterprise releases

HP publishes Smart Update Manager bulletin identifying version 6.4.1 as the fix