CVE-2014-2234 — Improper Input Validation in Apple MAC OS X

CWE-20 — Improper Input Validation3 documents3 sources
Severity
6.4MEDIUMNVD
EPSS
0.1%
top 70.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apple MAC OS XDebian Openssl
Timeline
PublishedMar 5
Latest updateMay 17

Description

A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify callback function's documentation, which allows remote attackers to bypass extra verification within a custom application via a crafted certificate chain that is acceptable to TEA but not acceptable to that application.

CVSS vector

AV:N/AC:L/C:P/I:P/A:NExploitability: 10.0 | Impact: 4.9

Affected Packages2 packages

▶NVDapple/mac_os_x10.9.2

🔴Vulnerability Details

1
GHSA
GHSA-h934-3chc-qfjv: A certain Apple patch for OpenSSL in Apple OS X 10↗2022-05-17
▶

📋Vendor Advisories

1
Debian
CVE-2014-2234: openssl - A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust ...↗2014
▶