CVE-2014-3470: The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and...

Security readout for executives and security teams

This OpenSSL flaw can let a remote party crash affected SSL/TLS clients in a narrow configuration: anonymous ECDH cipher suites. The known impact is denial of service, not data theft or code execution, based on the provided sources. Exposure is most likely in legacy products or systems still using affected OpenSSL branches and permitting anonymous ECDH cipher suites. The source bundle does not identify broad modern exposure or affected CPEs. Treat this as a legacy exposure cleanup item unless critical business clients still use vulnerable OpenSSL with anonymous ECDH enabled. Prioritize internet-facing or untrusted-connection clients first. Mitigation focus: Upgrade OpenSSL to 0.9.8za, 1.0.0m, 1.0.1h, or later supported vendor builds.; Apply relevant vendor updates from IBM, Novell, VMware, HP, or other affected product suppliers.; Disable anonymous ECDH cipher suites where vendor configuration guidance supports it..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.