Unscored severity · published Nov 24, 2014
CVE-2014-8627
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors
–
CVSS
2.1%
EPSS
No
On KEV
Description
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Polarssl · Polarssl
1.3.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8627
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8627
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html
secunia.com
http://secunia.com/advisories/61220
polarssl.org
https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released
More from Polarssl
9.8
CVE-2011-4574
PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm
7.4
CVE-2012-2130
A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys
–
CVE-2015-8036
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and…
–
CVE-2015-5291
Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial…
–
CVE-2014-9744
Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages