CVE-2014-2234

CVE-2014-2234 describes a vulnerability in Apple OS X 10.9.2 and earlier, where a specific OpenSSL patch incorrectly uses a Trust Evaluation Agent (TEA) feature. This flaw allows remote attackers to bypass custom application-level certificate verification by presenting a crafted certificate chain that TEA accepts, even if the application's SSL_CTX_set_verify callback would reject it. The vulnerability has a CVSS score of 6.4 (Medium), indicating a network-based attack with low complexity, requiring no authentication, and potentially leading to partial confidentiality and integrity compromise. Its EPSS score is very low, suggesting a minimal likelihood of exploitation. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are also absent, indicating a lack of widespread attention or exploitation.