{"id":"CVE-2014-3566","published":"2014-10-15T00:00:00Z","modified":"2026-05-28T17:35:01Z","title":"The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the \"POODLE\" issue.","provenance":"source","from":"CVE.org"},"summary":{"text":"The SSL 3.0 protocol, as used in OpenSSL through 1.0.1i and other products, relies on nondeterministic CBC padding that makes it possible for an attacker to recover cleartext data through a padding-oracle attack. Exploitation requires the attacker to be positioned as a man-in-the-middle on the network path, with a high-complexity attack and user interaction needed to trigger it.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:50Z"},"cvss":{"score":3.4,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.99999,"percentile":1.0,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":7,"pulses":[{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e","created":"2026-03-22"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de","created":"2026-03-22"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"“Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)","url":"https://otx.alienvault.com/pulse/698e93e1ab02db8c49e8c3ed","created":"2026-02-13"},{"name":"Python: OVSAgentServer Document (autofilled name)","url":"https://otx.alienvault.com/pulse/6660c1268a1f430e17236b55","created":"2024-06-05"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"},{"name":"Internal CVE Research","url":"https://otx.alienvault.com/pulse/6228b4f0b2d5ade72cc7a0ea","created":"2022-03-09"}],"provenance":"machine"},"cwes":[{"id":"CWE-329","name":"Generation of Predictable IV with CBC Mode"}],"references":[{"url":"http://marc.info/?l=bugtraq&m=142103967620673&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1031090","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://blog.nodejs.org/2014/10/23/node-v0-10-33-stable/","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1880.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://marc.info/?l=bugtraq&m=142804214608580&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04819635","tags":["x_refsource_CONFIRM"]},{"url":"http://www.kb.cert.org/vuls/id/577193","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"http://marc.info/?l=bugtraq&m=141577087123040&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=141715130023061&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://support.apple.com/kb/HT6542","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1031106","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://marc.info/?l=bugtraq&m=141697638231025&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=openssl-dev&m=141333049205629&w=2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://marc.info/?l=bugtraq&m=142350298616097&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=142350743917559&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://secunia.com/advisories/60056","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1877.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://marc.info/?l=bugtraq&m=141477196830952&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://secunia.com/advisories/61130","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1546.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00018.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://support.apple.com/kb/HT6529","tags":["x_refsource_CONFIRM"]},{"url":"https://www.openssl.org/news/secadv_20141015.txt","tags":["x_refsource_CONFIRM"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1920.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id/1031087","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://marc.info/?l=bugtraq&m=143628269912142&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667","tags":["x_refsource_CONFIRM"]},{"url":"https://bto.bluecoat.com/security-advisory/sa83","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=141879378918327&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://support.citrix.com/article/CTX200238","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/61359","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://support.apple.com/kb/HT6541","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1031093","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.securitytracker.com/id/1031132","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.debian.org/security/2015/dsa-3144","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://marc.info/?l=bugtraq&m=142721887231400&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.debian.org/security/2015/dsa-3253","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://marc.info/?l=bugtraq&m=142660345230545&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034","tags":["x_refsource_CONFIRM"]},{"url":"https://www.suse.com/support/kb/doc.php?id=7015773","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/archive/1/533724/100/0/threaded","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"https://www.elastic.co/blog/logstash-1-4-3-released","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=142296755107581&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","tags":["x_refsource_CONFIRM"]},{"url":"http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html","tags":["x_refsource_MISC"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=142805027510172&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://secunia.com/advisories/61827","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://marc.info/?l=bugtraq&m=141450452204552&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0079.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21688283","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=142791032306609&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://technet.microsoft.com/library/security/3009008.aspx","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1545.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www-01.ibm.com/support/docview.wss?uid=swg21688165","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=142624619906067&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.securitytracker.com/id/1031094","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2015-0003.html","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/61316","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://security.gentoo.org/glsa/201606-11","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1881.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://www.imperialviolet.org/2014/10/14/poodle.html","tags":["x_refsource_MISC"]},{"url":"http://www.securitytracker.com/id/1031096","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://secunia.com/advisories/61810","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.debian.org/security/2014/dsa-3053","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://support.lenovo.com/us/en/product_security/poodle","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1031107","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.securitytracker.com/id/1031095","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://marc.info/?l=bugtraq&m=143290583027876&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://marc.info/?l=bugtraq&m=142962817202793&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=143101048219218&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=142118135300698&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.securitytracker.com/id/1031091","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://marc.info/?l=bugtraq&m=142495837901899&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.securitytracker.com/id/1031123","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566","tags":["x_refsource_MISC"]},{"url":"https://support.apple.com/HT205217","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1031092","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00033.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://secunia.com/advisories/61926","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1876.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-3566.html","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=141450973807288&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=141814011518700&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=145983526810210&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1076983","tags":["x_refsource_CONFIRM"]},{"url":"https://support.apple.com/kb/HT6531","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://devcentral.f5.com/articles/cve-2014-3566-removing-sslv3-from-big-ip","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0264.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10091","tags":["x_refsource_CONFIRM"]},{"url":"https://support.apple.com/kb/HT6527","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=142350196615714&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=141697676231104&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://secunia.com/advisories/60206","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1152789","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/60792","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://www.debian.org/security/2016/dsa-3489","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://security.netapp.com/advisory/ntap-20141015-0001/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1031105","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141114.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.securitytracker.com/id/1031131","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.ubuntu.com/usn/USN-2487-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://marc.info/?l=bugtraq&m=142740155824959&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=141813976718456&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://www.dfranke.us/posts/2014-10-14-how-poodle-happened.html","tags":["x_refsource_MISC"]},{"url":"http://www.securitytracker.com/id/1031130","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://marc.info/?l=bugtraq&m=142721830231196&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=141577350823734&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1948.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc","tags":["vendor-advisory","x_refsource_NETBSD"]},{"url":"http://marc.info/?l=bugtraq&m=141620103726640&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1653.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00036.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://marc.info/?l=bugtraq&m=144101915224472&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=isg3T1021431","tags":["x_refsource_CONFIRM"]},{"url":"http://support.apple.com/HT204244","tags":["x_refsource_CONFIRM"]},{"url":"http://blogs.technet.com/b/msrc/archive/2014/10/14/security-advisory-3009008-released.aspx","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=142624679706236&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0085.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","tags":["x_refsource_CONFIRM"]},{"url":"https://support.apple.com/kb/HT6536","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-November/142330.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://marc.info/?l=bugtraq&m=141576815022399&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://groups.google.com/forum/#%21topic/docker-user/oYm0i3xShJU","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://marc.info/?l=bugtraq&m=143290371927178&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1652.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://support.apple.com/kb/HT6535","tags":["x_refsource_CONFIRM"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","tags":["x_refsource_MISC"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://marc.info/?l=bugtraq&m=142546741516006&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0086.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://marc.info/?l=bugtraq&m=143039249603103&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.securitytracker.com/id/1031124","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0080.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1882.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0068.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://marc.info/?l=bugtraq&m=142354438527235&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.ubuntu.com/usn/USN-2486-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://marc.info/?l=bugtraq&m=144294141001552&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://secunia.com/advisories/59627","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://marc.info/?l=bugtraq&m=141694355519663&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=143290437727362&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://support.lenovo.com/product_security/poodle","tags":["x_refsource_CONFIRM"]},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141015-poodle","tags":["vendor-advisory","x_refsource_CISCO"]},{"url":"http://marc.info/?l=bugtraq&m=141775427104070&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0698.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://downloads.asterisk.org/pub/security/AST-2014-011.html","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/60859","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/533746","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"https://security.gentoo.org/glsa/201507-14","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://marc.info/?l=bugtraq&m=142624719706349&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=142496355704097&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-405500.htm","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/61345","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/61019","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/bid/70574","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1031120","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_openssl6","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/61825","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://advisories.mageia.org/MGASA-2014-0416.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1031029","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04583581","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=142624590206005&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/","tags":["x_refsource_CONFIRM"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=143290522027658&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10104","tags":["x_refsource_CONFIRM"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/61782","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://access.redhat.com/articles/1232123","tags":["x_refsource_CONFIRM"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:062","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169361.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.securitytracker.com/id/1031085","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://marc.info/?l=bugtraq&m=144251162130364&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/archive/1/533747","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21687611","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/mpgn/poodle-PoC","tags":["x_refsource_MISC"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:203","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://marc.info/?l=bugtraq&m=142607790919348&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://blog.cryptographyengineering.com/2014/10/attack-of-week-poodle.html","tags":["x_refsource_MISC"]},{"url":"https://support.citrix.com/article/CTX216642","tags":["x_refsource_CONFIRM"]},{"url":"https://puppet.com/security/cve/poodle-sslv3-vulnerability","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://secunia.com/advisories/61303","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21692299","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1031039","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00066.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21687172","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00026.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://marc.info/?l=bugtraq&m=142624619906067","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.securitytracker.com/id/1031089","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://marc.info/?l=bugtraq&m=141628688425177&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA14-290A","tags":["third-party-advisory","x_refsource_CERT"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141158.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://secunia.com/advisories/61819","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://marc.info/?l=bugtraq&m=142357976805598&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.securitytracker.com/id/1031088","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.debian.org/security/2015/dsa-3147","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://secunia.com/advisories/61995","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://marc.info/?l=bugtraq&m=141703183219781&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21686997","tags":["x_refsource_CONFIRM"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10090","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1031086","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://marc.info/?l=bugtraq&m=143558192010071&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1692.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169374.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://www.openssl.org/~bodo/ssl-poodle.pdf","tags":["x_refsource_MISC"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=isg3T1021439","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=143558137709884&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisories/1015-security-advisory-7","tags":["x_refsource_MISC"]},{"url":"https://templatelab.com/ssl-poodle/","tags":[]}],"techniques":[{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2014-3547","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-3547","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2014-10-16","earliestUrl":"https://github.com/mikesplain/CVE-2014-3566-poodle-cookbook","repos":[{"name":"mpgn/poodle-PoC","url":"https://github.com/mpgn/poodle-PoC","stars":268,"created":"2015-02-03"},{"name":"mikesplain/CVE-2014-3566-poodle-cookbook","url":"https://github.com/mikesplain/CVE-2014-3566-poodle-cookbook","stars":3,"created":"2014-10-16"},{"name":"cloudpassage/mangy-beast","url":"https://github.com/cloudpassage/mangy-beast","stars":0,"created":"2014-10-20"},{"name":"GoRuGoo/poodle-attack-sandbox","url":"https://github.com/GoRuGoo/poodle-attack-sandbox","stars":0,"created":"2024-11-14"},{"name":"josecl200/VC-PoodlePOC","url":"https://github.com/josecl200/VC-PoodlePOC","stars":0,"created":"2026-04-26"}]},"metasploit":[{"name":"SSL/TLS Version Detection","module":"auxiliary/scanner/ssl/ssl_version","type":"auxiliary","disclosureDate":"2014-10-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb"}],"first":{"date":"2014-10-14","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb"},"provenance":"source"},"exploitRefs":["https://github.com/mpgn/poodle-PoC"],"flow":[{"stage":"related","techniques":["T1557"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2014-10-14","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2014-10-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb","provenance":"source"},{"date":"2014-10-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2014-3566","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":29.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 6 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":2.38,"detail":"base score 3.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-cve-2014-3566-family-cve-2014-3566","children":[{"from":"CVE-2014-3566","to":"CVE-2014-8730","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"…x before TLS 1.2, does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","from":"CVE.org","in":"CVE-2014-8730"}]},{"from":"CVE-2014-3566","to":"CVE-2015-2774","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"…P before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","from":"CVE.org","in":"CVE-2015-2774"}]},{"from":"CVE-2014-3566","to":"CVE-2015-3642","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"…0.13, 10.1.e before Build 130.1302.e, 10.5 before Build 55.8, and 10.5.e before Build 55.8007.e makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","from":"CVE.org","in":"CVE-2015-3642"}]},{"from":"CVE-2014-3566","to":"CVE-2015-4078","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"…re 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","from":"CVE.org","in":"CVE-2015-4078"}]}]}}