2.6

CVE-2013-0169

EPSS 1.08%
Published 08.02.2013 19:55:01
Last modified 11.04.2025 00:51:21
Source secalert@redhat.com
Teams watchlist Login
Open Login

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

Affected products Warnungen 0 Metrics 2 CWE 0 References 58

Data is provided by the National Vulnerability Database (NVD)

OpenSSL ≫ OpenSSL Version >= 0.9.8 <= 0.9.8x

OpenSSL ≫ OpenSSL Version >= 1.0.0 <= 1.0.0j

OpenSSL ≫ OpenSSL Version >= 1.0.1 <= 1.0.1d

Oracle ≫ Openjdk Version1.6.0 Update-

Oracle ≫ Openjdk Version1.6.0 Updateupdate1

Oracle ≫ Openjdk Version1.6.0 Updateupdate10

Oracle ≫ Openjdk Version1.6.0 Updateupdate11

Oracle ≫ Openjdk Version1.6.0 Updateupdate12

Oracle ≫ Openjdk Version1.6.0 Updateupdate13

Oracle ≫ Openjdk Version1.6.0 Updateupdate14

Oracle ≫ Openjdk Version1.6.0 Updateupdate15

Oracle ≫ Openjdk Version1.6.0 Updateupdate16

Oracle ≫ Openjdk Version1.6.0 Updateupdate17

Oracle ≫ Openjdk Version1.6.0 Updateupdate18

Oracle ≫ Openjdk Version1.6.0 Updateupdate19

Oracle ≫ Openjdk Version1.6.0 Updateupdate2

Oracle ≫ Openjdk Version1.6.0 Updateupdate20

Oracle ≫ Openjdk Version1.6.0 Updateupdate21

Oracle ≫ Openjdk Version1.6.0 Updateupdate22

Oracle ≫ Openjdk Version1.6.0 Updateupdate23

Oracle ≫ Openjdk Version1.6.0 Updateupdate24

Oracle ≫ Openjdk Version1.6.0 Updateupdate25

Oracle ≫ Openjdk Version1.6.0 Updateupdate26

Oracle ≫ Openjdk Version1.6.0 Updateupdate27

Oracle ≫ Openjdk Version1.6.0 Updateupdate29

Oracle ≫ Openjdk Version1.6.0 Updateupdate3

Oracle ≫ Openjdk Version1.6.0 Updateupdate30

Oracle ≫ Openjdk Version1.6.0 Updateupdate31

Oracle ≫ Openjdk Version1.6.0 Updateupdate32

Oracle ≫ Openjdk Version1.6.0 Updateupdate33

Oracle ≫ Openjdk Version1.6.0 Updateupdate34

Oracle ≫ Openjdk Version1.6.0 Updateupdate35

Oracle ≫ Openjdk Version1.6.0 Updateupdate37

Oracle ≫ Openjdk Version1.6.0 Updateupdate38

Oracle ≫ Openjdk Version1.6.0 Updateupdate4

Oracle ≫ Openjdk Version1.6.0 Updateupdate5

Oracle ≫ Openjdk Version1.6.0 Updateupdate6

Oracle ≫ Openjdk Version1.6.0 Updateupdate7

Oracle ≫ Openjdk Version1.7.0 Update-

Oracle ≫ Openjdk Version1.7.0 Updateupdate1

Oracle ≫ Openjdk Version1.7.0 Updateupdate10

Oracle ≫ Openjdk Version1.7.0 Updateupdate11

Oracle ≫ Openjdk Version1.7.0 Updateupdate13

Oracle ≫ Openjdk Version1.7.0 Updateupdate2

Oracle ≫ Openjdk Version1.7.0 Updateupdate3

Oracle ≫ Openjdk Version1.7.0 Updateupdate4

Oracle ≫ Openjdk Version1.7.0 Updateupdate5

Oracle ≫ Openjdk Version1.7.0 Updateupdate6

Oracle ≫ Openjdk Version1.7.0 Updateupdate7

Oracle ≫ Openjdk Version1.7.0 Updateupdate9

Polarssl ≫ Polarssl Version0.10.0

Polarssl ≫ Polarssl Version0.10.1

Polarssl ≫ Polarssl Version0.11.0

Polarssl ≫ Polarssl Version0.11.1

Polarssl ≫ Polarssl Version0.12.0

Polarssl ≫ Polarssl Version0.12.1

Polarssl ≫ Polarssl Version0.13.1

Polarssl ≫ Polarssl Version0.14.0

Polarssl ≫ Polarssl Version0.14.2

Polarssl ≫ Polarssl Version0.14.3

Polarssl ≫ Polarssl Version0.99 Updatepre1

Polarssl ≫ Polarssl Version0.99 Updatepre3

Polarssl ≫ Polarssl Version0.99 Updatepre4

Polarssl ≫ Polarssl Version0.99 Updatepre5

Polarssl ≫ Polarssl Version1.0.0

Polarssl ≫ Polarssl Version1.1.0

Polarssl ≫ Polarssl Version1.1.0 Updaterc0

Polarssl ≫ Polarssl Version1.1.0 Updaterc1

Polarssl ≫ Polarssl Version1.1.1

Polarssl ≫ Polarssl Version1.1.2

Polarssl ≫ Polarssl Version1.1.3

Polarssl ≫ Polarssl Version1.1.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	1.08%	0.771

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	2.6	4.9	2.9	AV:N/AC:H/Au:N/C:P/I:N/A:N

http://security.gentoo.org/glsa/glsa-201406-32.xml

Third Party Advisory

http://www.kb.cert.org/vuls/id/737740

Third Party Advisory

US Government Resource

http://rhn.redhat.com/errata/RHSA-2013-1455.html

Third Party Advisory

http://secunia.com/advisories/55322

Third Party Advisory

http://secunia.com/advisories/55350

Third Party Advisory

http://secunia.com/advisories/55351

Third Party Advisory

http://www.securitytracker.com/id/1029190

Third Party Advisory

VDB Entry

https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

Third Party Advisory

http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html

Third Party Advisory

Mailing List

http://support.apple.com/kb/HT5880

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-1456.html

Third Party Advisory

http://marc.info/?l=bugtraq&m=136432043316835&w=2

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21644047

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0587.html

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2013:095

Third Party Advisory

http://marc.info/?l=bugtraq&m=136439120408139&w=2

Third Party Advisory

http://marc.info/?l=bugtraq&m=136733161405818&w=2

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0833.html

Third Party Advisory

http://marc.info/?l=bugtraq&m=137545771702053&w=2

Third Party Advisory

http://secunia.com/advisories/55108

Third Party Advisory

http://secunia.com/advisories/55139

Third Party Advisory

http://www.openssl.org/news/secadv_20130204.txt

Vendor Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Third Party Advisory

http://marc.info/?l=bugtraq&m=136396549913849&w=2

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0782.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0783.html

Third Party Advisory

http://secunia.com/advisories/53623

Third Party Advisory

http://www.debian.org/security/2013/dsa-2621

Third Party Advisory

http://www.splunk.com/view/SP-CAAAHXG

Third Party Advisory

http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html

Third Party Advisory

http://openwall.com/lists/oss-security/2013/02/05/24

Mailing List

http://www.debian.org/security/2013/dsa-2622

Third Party Advisory

http://www.isg.rhul.ac.uk/tls/TLStiming.pdf

Third Party Advisory

http://www.matrixssl.org/news.html

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html

Third Party Advisory

http://www.securityfocus.com/bid/57778

Third Party Advisory

VDB Entry

http://www.ubuntu.com/usn/USN-1735-1

Third Party Advisory

http://www.us-cert.gov/cas/techalerts/TA13-051A.html

Third Party Advisory

US Government Resource

https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18841

Tool Signature

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19016

Tool Signature

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19424

Tool Signature

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19540

Tool Signature

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19608

Third Party Advisory

https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released

Vendor Advisory

https://puppet.com/security/cve/cve-2013-0169

Third Party Advisory

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2013-0169

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-0169

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-0169

EUVD