CVE-2014-8627
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote...
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
- Record
CVE-2014-8627- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
- Record
CVE-2014-8627- Updated
- 2026-11-02
EUVDEUVD-2014-8464 No score
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
- Record
EUVD-2014-8464- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9jjq-g2xm-68mw No score
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote...
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
- Record
GHSA-9jjq-g2xm-68mw- Updated
- 2026-11-02
OSVMGASA-2014-0481 No score
Updated polarssl package fix security vulnerabilities
A regression in PolarSSL 1.3.8 resulted in servers negotiating a weaker signature algorithm than available. This has been fixed in PolarSSL 1.3.9 (CVE-2014-8627).
Two remotely-triggerable memory leaks were found by the Codenomicon Defensics tool and fixed in PolarSSL 1.3.9 (CVE-2014-8628).
- Record
MGASA-2014-0481- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10088-1 No score
libmbedcrypto0-2.4.0-1.2 on GA media
These are all security issues fixed in the libmbedcrypto0-2.4.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10088-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12903-1 No score
libmbedcrypto7-2.28.3-1.1 on GA media
These are all security issues fixed in the libmbedcrypto7-2.28.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12903-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11119-1 No score
libeverest-3.6.6-1.1 on GA media
These are all security issues fixed in the libeverest-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11119-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
polarsslMageia:3 From an advisory covering 2 CVEs |
before 1.3.9-1.mga3 | 1.3.9-1.mga3 |
polarsslMageia:4 From an advisory covering 2 CVEs |
before 1.3.9-1.mga4 | 1.3.9-1.mga4 |
mbedtlsopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.4.0-1.2 | 2.4.0-1.2 |
mbedtls-2openSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.28.3-1.1 | 2.28.3-1.1 |
mbedtls-3openSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 3.6.6-1.1 | 3.6.6-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8627 is a medium vulnerability (CVSS 5.0) in Polarssl, published November 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.09%, the 81st percentile. No source names a fixed version.
References
lists.opensuse.org/opensuse-updates/2014-11/msg00079.html
polarssl.org/tech-updates/releases/polarssl-1.3.9-released
secunia.com/advisories/61220
nvd.nist.gov/vuln/detail/CVE-2014-8627
github.com/advisories/GHSA-9jjq-g2xm-68mw
advisories.mageia.org/MGASA-2014-0481.html
Show 16 moreShow less
bugs.mageia.org/show_bug.cgi?id=14472
openwall.com/lists/oss-security/2014/11/06/4
suse.com/security/cve/CVE-2014-8627