CVE-2014-3511

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.1j Gentoo Linux (affected versions not specified)

Description The issue allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue. This can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information. The vulnerability is in the ssl23 get client hello function in s23 srvr.c.

Recommendations For OpenSSL versions prior to 1.0.1j, update to version 1.0.1j or later to resolve the issue. As a temporary workaround, consider restricting the use of TLS 1.0 until a patch is available. Avoid using the ssl23 get client hello function in s23 srvr.c until the issue is resolved.