CVE-2014-0160highunder attackCWE-125

CVE-2014-0160

Published 07 Apr 2014 · Updated 22 Oct 2025

Follow this CVE + Monitor OpenSSL + Monitor openssl

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 100%

from disclosure to weaponsame day

Published on NVDApr 7

1st PoCApr 7

metasploitApr 7

CISA KEV+2949d

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Fixed

11 products (85 components)

Red Hat Enterprise Linux Server (v. 6) · Red Hat Enterprise Linux Server Optional (v. 6) · Red Hat Enterprise Linux Desktop Optional (v. 6) · Red Hat Enterprise Linux HPC Node Optional (v. 6) · Red Hat Enterprise Linux Workstation (v. 6) · and others 6

fix ↗

Not affected

5 products (14 components) — because the vulnerable code is not present in the product

Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 5 · Red Hat Enterprise Linux 6 · Red Hat JBoss Enterprise Application Platform 5 · Red Hat JBoss Enterprise Application Platform 6

Action required by CISAfederal deadline: 2022-05-25

Apply updates per vendor instructions.

In short

OpenSSL's Heartbeat feature has a flaw that lets attackers read sensitive data like private keys directly from server memory by sending specially crafted requests. This is critical because it exposes private encryption keys that should never be shared.

Technical detail

The Heartbeat Extension in OpenSSL 1.0.1 before 1.0.1g contains an out-of-bounds read vulnerability in the heartbeat response mechanism (d1_both.c, t1_lib.c). Remote attackers can trigger a buffer over-read via crafted heartbeat packets without authentication, allowing exfiltration of arbitrary process memory including private keys and other sensitive data.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

n/a · n/a

public PoCs found — 125✓ VexDay Proof

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://advisories.mageia.org/MGASA-2014-0165.html http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/http://cogentdatahub.com/ReleaseNotes.html http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01 http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=96db9023b881d7cd9f379b0c154650d6c108e9a3 http://heartbleed.com/http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.html http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.html http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00005.html http://lists.opensuse.org/opensuse-updates/2014-04/msg00061.html