Back

LOW

SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack

Published Oct 15, 2014

Description

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

Affected products

Remediation

Red Hat statement

This issue affects the version of openssl as shipped with Red Hat Enterprise Linux 5, 6 and 7, Red Hat JBoss Enterprise Application Platform 5 and 6, and Red Hat JBoss Web Server 1 and 2, Red Hat Enterprise Virtualization Hypervisor 6.5, and Red Hat Storage 2.1. This issue affects the version of nss as shipped with Red Hat Enterprise Linux 5, 6 and 7. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/articles/1232123

Metrics

References (247)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Oct 15, 2014
Updated May 28, 2026
Reserved May 14, 2014
CISA Vulnrichment
Updated May 28, 2026
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Important
Public date Oct 14, 2014