CVE:CVE-2014-0224
CNNVD:CNNVD-201406-080
OpenSSL是OpenSSL团队开发的一个开源的能够实现安全套接层（SSL v2/v3）和安全传输层（TLS v1）协议的通用加密库，它支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。
OpenSSL中存在安全漏洞，该漏洞源于程序没有正确限制ChangeCipherSpec消息的处理。攻击者可借助特制的TLS握手利用该漏洞实施中间人攻击，在OpenSSL-to-OpenSSL通信过程中使用零长度的主密钥，劫持会话或获取敏感消息。以下版本受到影响：OpenSSL 0.9.8y及之前的版本，1.0.0m之前的1.0.0版本，1.0.1h之前的1.0.1版本。
solution:Upgrade openssl openssl to a higher version than 0.9.8za,1.0.0m,1.0.1h,and avoid the version (,0.9.8za),[1.0.0,1.0.0m),[1.0.1,1.0.1h); Upgrade redhat jboss_enterprise_application_platform to a higher version than 5.2.0,6.2.3,and avoid the version 5.2.0,6.2.3; Upgrade redhat jboss_enterprise_web_platform to a higher version than 5.2.0,and avoid the version 5.2.0; Upgrade redhat jboss_enterprise_web_server to a higher version than 2.0.1,and avoid the version 2.0.1; Upgrade redhat storage to a higher version than 2.1,and avoid the version 2.1; Upgrade fedoraproject fedora to a higher version than 19,20,and avoid the version 19,20; Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2; Upgrade redhat enterprise_linux to a higher version than 4,5,6.0,and avoid the version 4,5,6.0; Upgrade filezilla-project filezilla_server to a higher version than 0.9.45,and avoid the version (,0.9.45); Upgrade siemens application_processing_engine_firmware to a higher version than 2.0.2,and avoid the version (,2.0.2); Upgrade siemens cp1543-1_firmware to a higher version than 1.1.25,and avoid the version (,1.1.25); Upgrade siemens s7-1500_firmware to a higher version than 1.6,and avoid the version (,1.6); Upgrade siemens rox_firmware to a higher version than 1.16.1,and avoid the version (,1.16.1); Upgrade mariadb mariadb to a higher version than 10.0.13,and avoid the version [10.0.0,10.0.13); Upgrade python python to a higher version than 2.7.8,3.4.2,and avoid the version [2.7.0,2.7.8),[3.4.0,3.4.2); Upgrade nodejs node.js to a higher version than 0.10.29,and avoid the version (,0.10.29)