Skip to main content

Polarssl CVE-2014-8627

MEDIUM
Cryptographic Issues (CWE-310)
2014-11-24 security@opentext.com
Information Disclosure Polarssl
5.0
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
5.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:N/I:P/A:N
Attack Vector
Network
Attack Complexity
Low
Confidentiality
None
Integrity
P
Availability
None

Lifecycle Timeline

1
CVE Published
Nov 24, 2014 - 15:59 cve.org
MEDIUM 5.0

DescriptionCVE.org

PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

AnalysisAI

PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors. Affected products include: Polarssl.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Polarssl

View all
CVE-2013-4623 MEDIUM POC
4.3 Sep 30

The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certi
CVE-2014-9744 HIGH
7.8 Aug 24

Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a lar
CVE-2014-8628 HIGH
7.8 Aug 24

Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memor
CVE-2015-1182 HIGH
7.5 Jan 27

The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not
CVE-2013-5914 MEDIUM
6.8 Oct 26

Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow r
CVE-2014-4911 MEDIUM
5.0 Jul 22

The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attacke
CVE-2013-5915 MEDIUM
4.3 Oct 04

The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might all
CVE-2013-1621 MEDIUM
4.3 Feb 08

Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers to cause a denial of service v
CVE-2013-0169 LOW
2.6 Feb 08

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other product

Same weakness CWE-310 – Cryptographic Issues

View all
CVE-2015-0204 MEDIUM POC
4.3
CVE-2015-4000 LOW POC
3.7
CVE-2014-3566 LOW POC
3.4
CVE-2014-8684 CRITICAL POC
9.8
CVE-2012-1803 HIGH POC
8.5
CVE-2013-4787 CRITICAL POC
9.3
CVE-2014-8686 CRITICAL POC
9.8
CVE-2013-0137 CRITICAL
10.0

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2014-8627 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy