CVE-2014-0160

High · CVSS 7.5EPSS 100.0%CISA KEVCWE-125 · Out-of-bounds Read

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

References

NVD MITRE CVE.org CISA KEV

Published Apr 7, 2014

Community ground truth

Community verdict

3 verdicts

Not a real issue

Includes TruePositive's curated baseline from public sources — community verdicts accrue on top.

to add your verdict.

Community real-world severity: High (High 3) — CVSS base score 7.5

In line with its CVSS base score.

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

0
Field note · Priya NairCurated
Reads up to 64KB of process memory per heartbeat, no auth, no trace in normal logs. It's 'only' info disclosure, so not a CVSS 10, but in practice you must assume private keys and session tokens leaked — hence high, not medium.
0
Remediation · Diego RamírezCurated
Patch OpenSSL (1.0.1g+), then rotate every private key and re-issue certs, and invalidate sessions. Patching alone is not remediation here.