1. Home
  2. CVE Database
  3. CVE-2014-2234
MEDIUM · 6.4

CVE-2014-2234

A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify cal...

Vulnerability Description

A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify callback function's documentation, which allows remote attackers to bypass extra verification within a custom application via a crafted certificate chain that is acceptable to TEA but not acceptable to that application.

CVSS Score

6.4

MEDIUM

AV:N/AC:L/Au:N/C:P/I:P/A:N
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
NONE

Affected Products

VendorProductVersions
AppleMac Os X<= 10.9.2

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2014-2234?

CVE-2014-2234 is a vulnerability with a CVSS score of 6.4 (MEDIUM). A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify cal...

How severe is CVE-2014-2234?

CVE-2014-2234 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-2234?

Check the references section above for vendor advisories and patch information. Affected products include: Apple Mac Os X.