CVE-2013-0169
At a glance
- Source
- NVD
- EPSS
- EPSS 35.58 % · percentile 98 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
Weaknesses (CWE)
References
- https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html
- http://www.matrixssl.org/news.html
- http://rhn.redhat.com/errata/RHSA-2013-0587.html
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html
- http://www.us-cert.gov/cas/techalerts/TA13-051A.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19016
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:095
- http://secunia.com/advisories/55139
- http://secunia.com/advisories/55322
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19608
- http://www.openssl.org/news/secadv_20130204.txt
- http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084
- http://www.isg.rhul.ac.uk/tls/TLStiming.pdf
- http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html
- http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html
- http://www.debian.org/security/2013/dsa-2622
- http://www.securityfocus.com/bid/57778
- http://www-01.ibm.com/support/docview.wss?uid=swg21644047
- http://openwall.com/lists/oss-security/2013/02/05/24
- http://rhn.redhat.com/errata/RHSA-2013-1455.html
- http://secunia.com/advisories/55351
- http://marc.info/?l=bugtraq&m=136396549913849&w=2
- https://puppet.com/security/cve/cve-2013-0169
- http://marc.info/?l=bugtraq&m=137545771702053&w=2
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
- http://marc.info/?l=bugtraq&m=136432043316835&w=2
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html
- http://rhn.redhat.com/errata/RHSA-2013-0833.html
- http://www.ubuntu.com/usn/USN-1735-1
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
- http://marc.info/?l=bugtraq&m=136439120408139&w=2
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001
- http://secunia.com/advisories/53623
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html
- http://www.kb.cert.org/vuls/id/737740
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19424
- http://www.debian.org/security/2013/dsa-2621
- http://rhn.redhat.com/errata/RHSA-2013-0783.html
- http://marc.info/?l=bugtraq&m=136733161405818&w=2
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
- http://secunia.com/advisories/55108
- http://rhn.redhat.com/errata/RHSA-2013-0782.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html
- https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19540
- http://www.securitytracker.com/id/1029190
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18841
- +5 more
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | LOW 2.6 | AV:N/AC:H/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2013-0208
- GCVE · GCVE-0-2013-0169
CERT-FR advisories
- CERTFR-2022-AVI-1094 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2021-AVI-214 — Multiples vulnérabilités dans Moxa EDR-810 · cert.ssi.gouv.fr
- CERTFR-2020-AVI-420 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2019-AVI-311 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2016-AVI-344 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2016-AVI-300 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2014-AVI-357 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2014-AVI-141 — Multiples vulnérabilités dans IBM Cognos Express · cert.ssi.gouv.fr
- CERTA-2013-AVI-575 — Multiples vulnérabilités dans Oracle Fusion Middleware · cert.ssi.gouv.fr
- CERTA-2013-AVI-529 — Multiples vulnérabilités dans Apple OS X Mountain Lion · cert.ssi.gouv.fr
- CERTA-2013-AVI-527 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTA-2013-AVI-454 — Multiples vulnérabilités dans VMware ESX et ESXi · cert.ssi.gouv.fr
- CERTA-2013-AVI-416 — Multiples vulnérabilités dans Oracle Solaris · cert.ssi.gouv.fr
- CERTA-2013-AVI-413 — Multiples vulnérabilités dans Juniper Junos · cert.ssi.gouv.fr
- CERTA-2013-AVI-367 — Multiples vulnérabilités dans EMC RSA BSAFE · cert.ssi.gouv.fr
- CERTA-2013-AVI-339 — Multiples vulnérabilités dans IBM DB2 · cert.ssi.gouv.fr
- CERTA-2013-AVI-338 — Multiples vulnérabilités dans IBM Tivoli Directory Integrator · cert.ssi.gouv.fr
- CERTA-2013-AVI-151 — Multiples vulnérabilités dans Hitachi Cosminexus · cert.ssi.gouv.fr
- CERTA-2013-AVI-142 — Multiples vulnérabilités dans Oracle Java · cert.ssi.gouv.fr
- CERTA-2013-AVI-099 — Multiples vulnérabilités dans OpenSSL · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*≥ 0.9.8 ≤ 0.9.8xcpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*≥ 1.0.0 ≤ 1.0.0jcpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*≥ 1.0.1 ≤ 1.0.1dcpe:2.3:a:oracle:openjdk:1.6.0:-:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update1:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update10:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update11:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update12:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update13:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update14:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update15:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update16:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update17:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update18:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update19:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update2:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update20:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update21:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update22:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update23:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update24:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update25:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update26:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update27:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update29:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update3:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update30:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update31:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update32:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update33:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update34:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update35:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update37:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update38:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update4:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update5:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update6:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.6.0:update7:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.7.0:-:*:*:*:*:*:*cpe:2.3:a:oracle:openjdk:1.7.0:update1:*:*:*:*:*:*- +32 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |