Does CVE-2014-0195 (openSSL) affect HTTPS or only VPN tunnels?

Reference: https://security-tracker.debian.org/tracker/DSA-2950-1, https://isc.sans.edu/


"All versions of OpenSSL are vulnerable to CVE-2014-0195, but this vulnerability only affects DTLS clients or servers (look for SSL VPNs... not so much HTTPS)." is already right in the posting you linked to. If it is using DTLS, then it could be impacted potentially, but HTTPS generally doesn't.

  • "not so much HTTPS" is not very precise. I need more than that. – user1298720 Jun 5 '14 at 13:29
  • He was describing what generally uses DTLS. That's the key part. DTLS is the vulnerable component. If you are using it, then vulnerable, if not, then you aren't. – AJ Henderson Jun 5 '14 at 13:30
  • DTLS - so things like LDAP, SNMP, WebRTS, VOIP, DTLS VPN, etc. – JZeolla Jun 5 '14 at 14:18

This affects only DTLS(TLS over datagram). Hence, HTTPS and VPN tunnels which use TCP/IP would not be affected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.