CVE-2014-3566: Generation of Predictable IV with CBC Mode

🗓️ 15 Oct 2014 00:00:00Reported by Rapid7Type

rapid7🔗 www.rapid7.com👁 4 Views

Predictable IV in OpenSSL SSL 3.0 CBC mode allows man-in-the-middle padding-oracle attacks.

Reporter	Title	Published	Views	Family All 946
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Netcool Configuration Manager (ITNCM)	20 Dec 201916:10	–	ibm
IBM Security Bulletins	Security Bulletin:GSKit vulnerable to FREAK - GSKit Ephemeral RSA Vulnerability	3 Aug 201804:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in SSLv3 affects IBM Content Navigator (CVE-2014-3566)	17 Jun 201812:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in SSLv3 affects IBM Support Assistant Team Server (CVE-2014-3566)	15 Jun 201807:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in SSLv3 affects Tivoli Federated Identity Manager (CVE-2014-3566)	16 Jun 201821:20	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in SSLv3 affects multiple IBM Rational products based on IBM Jazz technology (CVE-2014-3566)	28 Apr 202118:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in SSLv3 affects IBM i (CVE-2014-3566)	18 Dec 201914:26	–	ibm
IBM Security Bulletins	Security Bulletin: WebSphere Process Server Hypervisor Edition vulnerability (CVE-2014-3566)	15 Jun 201807:02	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere Application Server (CVE-2014-3566)	8 Sep 202200:26	–	ibm
IBM Security Bulletins	Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.4	8 Sep 202200:26	–	ibm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2014-3566
cwe	www.cwe.mitre.org/data/definitions/329.html
cwe	www.cwe.mitre.org/data/definitions/310.html
ftp	www.ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-015.txt.asc
advisories	www.advisories.mageia.org/MGASA-2014-0416.html
aix	www.aix.software.ibm.com/aix/efixes/security/openssl_advisory11.asc
archives	www.archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
archives	www.archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
askubuntu	www.askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566
blog	www.blog.cryptographyengineering.com/2014/10/attack-of-week-poodle.html

28 May 2026 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.13.4

CVSS 24.3

EPSS0.99999

SSVC

CWE-329 CWE-310

OpenSSL SSL protocol 3.0 CBC mode padding-oracle attack POODLE man-in-the-middle