The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a pad…

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

• CISA KEV Not listed.
• EPSS 1.00, the 100th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 15 Oct 2014. New records show when each source confirmed them.

Sources

• CVE List: CVE-2014-3566
• NVD: CVE-2014-3566

References from the CNA

• marc.info/?l=bugtraq&m=142103967620673&w=2 vendor-advisoryhp
• aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc confirm
• www.securitytracker.com/id/1031090 vdb-entrysectrack
• blog.nodejs.org/2014/10/23/node-v0-10-33-stable/ confirm
• rhn.redhat.com/errata/RHSA-2014-1880.html vendor-advisoryredhat
• marc.info/?l=bugtraq&m=142804214608580&w=2 vendor-advisoryhp
• h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04819635 confirm
• www.kb.cert.org/vuls/id/577193 third-party-advisorycert-vn
• marc.info/?l=bugtraq&m=141577087123040&w=2 vendor-advisoryhp
• marc.info/?l=bugtraq&m=141715130023061&w=2 vendor-advisoryhp
• lists.opensuse.org/opensuse-security-announce/2014-10/msg00008.html vendor-advisorysuse
• support.apple.com/kb/HT6542 confirm
• www.securitytracker.com/id/1031106 vdb-entrysectrack
• marc.info/?l=bugtraq&m=141697638231025&w=2 vendor-advisoryhp
• www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html confirm
• marc.info/?l=openssl-dev&m=141333049205629&w=2 mailing-listmlist
• marc.info/?l=bugtraq&m=142350298616097&w=2 vendor-advisoryhp
• marc.info/?l=bugtraq&m=142350743917559&w=2 vendor-advisoryhp
• secunia.com/advisories/60056 third-party-advisorysecunia
• rhn.redhat.com/errata/RHSA-2014-1877.html vendor-advisoryredhat
• marc.info/?l=bugtraq&m=141477196830952&w=2 vendor-advisoryhp
• secunia.com/advisories/61130 third-party-advisorysecunia
• rhn.redhat.com/errata/RHSA-2015-1546.html vendor-advisoryredhat
• lists.opensuse.org/opensuse-security-announce/2015-03/msg00018.html vendor-advisorysuse
• support.apple.com/kb/HT6529 confirm
• www.openssl.org/news/secadv_20141015.txt confirm
• archives.neohapsis.com/archives/bugtraq/2014-10/0103.html vendor-advisoryapple
• www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 confirm
• rhn.redhat.com/errata/RHSA-2014-1920.html vendor-advisoryredhat
• www.securitytracker.com/id/1031087 vdb-entrysectrack

And 234 more on the CVE record.

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.