CVE-2014-0221
CVE-2014-0221 is a medium-severity vulnerability in Redhat Storage with a CVSS 2.0 base score of 4.3. Its EPSS exploit-prediction score of 88% places it in the 100th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: Medium (CVSS 2.0 base score 4.3)
- EPSS exploit prediction: 88% (100th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Redhat Storage
- Published:
- Last modified:
Description
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.
Frequently asked questions
- What is CVE-2014-0221?
- The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.
- How severe is CVE-2014-0221?
- CVE-2014-0221 has a CVSS 2.0 base score of 4.3, rated medium severity.
- Is CVE-2014-0221 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 88% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-0221?
- CVE-2014-0221 primarily affects Redhat Storage. In total, 14 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2014-0221?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2014-0221 published?
- CVE-2014-0221 was published on 2014-06-05 and last updated on 2026-06-17.
References
- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
- http://linux.oracle.com/errata/ELSA-2014-1053.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
- http://marc.info/?l=bugtraq&m=140266410314613&w=2
- http://marc.info/?l=bugtraq&m=140317760000786&w=2
- http://marc.info/?l=bugtraq&m=140389274407904&w=2
- http://marc.info/?l=bugtraq&m=140389355508263&w=2
- http://marc.info/?l=bugtraq&m=140431828824371&w=2
- http://marc.info/?l=bugtraq&m=140448122410568&w=2
- http://marc.info/?l=bugtraq&m=140482916501310&w=2
- http://marc.info/?l=bugtraq&m=140491231331543&w=2
- http://marc.info/?l=bugtraq&m=140499827729550&w=2
- http://marc.info/?l=bugtraq&m=140621259019789&w=2
- http://marc.info/?l=bugtraq&m=140752315422991&w=2
- http://marc.info/?l=bugtraq&m=140904544427729&w=2
- http://rhn.redhat.com/errata/RHSA-2014-1021.html
- http://seclists.org/fulldisclosure/2014/Dec/23
- http://secunia.com/advisories/58337
- http://secunia.com/advisories/58615
- http://secunia.com/advisories/58713
- http://secunia.com/advisories/58714
- http://secunia.com/advisories/58939
- http://secunia.com/advisories/58945
- http://secunia.com/advisories/58977
- http://secunia.com/advisories/59027
- http://secunia.com/advisories/59120
Affected products (14)
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:storage:2.1:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*
More vulnerabilities in Redhat Storage
- CVE-2022-26148 — Critical (CVSS 9.8): An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the…
- CVE-2012-4406 — Critical (CVSS 9.8): OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing…
- CVE-2012-1823 — Critical (CVSS 9.8): sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does…
- CVE-2012-1938 — Critical (CVSS 9.3): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 13.0, Thunderbird before 13.0, and…
- CVE-2023-3961 — Critical (CVSS 9.1): A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain…
- CVE-2012-0247 — High (CVSS 8.8): ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly…
All CVEs affecting Redhat Storage →
Threat intelligence
Threat-intel indicators referencing this CVE:
- 218.4.91.163 (ipv4-addr)
- 200.77.172.159 (ipv4-addr)
- 200.196.50.91 (ipv4-addr)
- 166.62.41.190 (ipv4-addr)
- 50.62.22.47 (ipv4-addr)
- 222.99.52.202 (ipv4-addr)
- 191.101.33.225 (ipv4-addr)
- 121.164.135.251 (ipv4-addr)