# CVE-2014-0160: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle He... > CVE-2014-0160 (GitHub advisory GHSA-w8r8-w5w4-4w4v) is a high-severity vulnerability with a CVSS 3.1 base score of 7.5, classed as Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119). No affected-package or version data has been published, so its fix status is unknown. CISA lists it as a known exploited vulnerability (added 4 May 2022). Canonical page: https://cveminer.com/vulnerabilities/CVE-2014-0160 | Field | Value | | --- | --- | | CVE | CVE-2014-0160 | | GHSA | GHSA-w8r8-w5w4-4w4v | | Severity | High | | CVSS 3.1 | 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` (GitHub Advisory Database) | | CWE | CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-125 Out-of-bounds Read | | EPSS | 99.99% (higher than 99.9% of CVEs) | | CISA KEV | Listed 4 May 2022, due 25 May 2022 | | SSVC | exploitation active, automatable yes, technical impact partial | | Published | 7 Apr 2014 | | Modified | 22 Oct 2025 | ## Description The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. ## Questions **What is the GHSA ID for CVE-2014-0160?** GitHub tracks CVE-2014-0160 as GHSA-w8r8-w5w4-4w4v. **What is the CVSS score of CVE-2014-0160?** CVE-2014-0160 has a CVSS 3.1 base score of 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. **How do I fix CVE-2014-0160?** No affected-package or version data has been published, so its fix status is unknown. **Is CVE-2014-0160 exploited in the wild?** CISA lists it as a known exploited vulnerability (added 4 May 2022). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.99% chance of exploitation in the next 30 days, higher than 99.9% of CVEs. ## References - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (fix) - http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html (fix) - https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E (fix) - https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E (fix) - https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E (fix) - https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E (fix) - http://advisories.mageia.org/MGASA-2014-0165.html (advisory) - http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/ (advisory) - http://cogentdatahub.com/ReleaseNotes.html (advisory) - http://heartbleed.com/ (advisory) - http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.html (advisory) - http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.html (advisory) - http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html (advisory) - http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html (advisory) - http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00005.html (advisory) - http://lists.opensuse.org/opensuse-updates/2014-04/msg00061.html (advisory) - http://marc.info/?l=bugtraq&m=139722163017074&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139757726426985&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139757819327350&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139757919027752&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139758572430452&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139765756720506&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139774054614965&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139774703817488&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139808058921905&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139817685517037&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139817727317190&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139817782017443&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139824923705461&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139824993005633&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139833395230364&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139835815211508&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139835844111589&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139836085512508&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139842151128341&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139843768401936&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139869720529462&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139869891830365&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139889113431619&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139889295732144&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139905202427693&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139905243827825&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139905295427946&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139905351928096&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139905405728262&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139905458328378&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139905653828999&w=2 (advisory) - http://marc.info/?l=bugtraq&m=139905868529690&w=2 (advisory) - http://marc.info/?l=bugtraq&m=140015787404650&w=2 (advisory) - http://marc.info/?l=bugtraq&m=140075368411126&w=2 (advisory) - http://marc.info/?l=bugtraq&m=140724451518351&w=2 (advisory) - http://marc.info/?l=bugtraq&m=140752315422991&w=2 (advisory) - http://marc.info/?l=bugtraq&m=141287864628122&w=2 (advisory) - http://marc.info/?l=bugtraq&m=142660345230545&w=2 (advisory) - http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=1 (advisory) - http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=3 (advisory) - http://rhn.redhat.com/errata/RHSA-2014-0376.html (advisory) - http://rhn.redhat.com/errata/RHSA-2014-0377.html (advisory) - http://rhn.redhat.com/errata/RHSA-2014-0378.html (advisory) - http://rhn.redhat.com/errata/RHSA-2014-0396.html (advisory) --- Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2014-0160), compiled from GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.