Fluid Attacks Database

Description

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	openssl	>=0 <1.0.1e-1	1.0.1e-1
debian 13	gnutls28	>=0 <3.0.22-3	3.0.22-3
debian 11	bouncycastle	>=0 <1.48+dfsg-2	1.48+dfsg-2
debian 13	nss	>=0 <2:3.14.3-1	2:3.14.3-1
debian 14	gnutls28	>=0 <3.0.22-3	3.0.22-3
debian 11	nss	>=0 <2:3.14.3-1	2:3.14.3-1
debian 11	gnutls28	>=0 <3.0.22-3	3.0.22-3
debian 12	openssl	>=0 <1.0.1e-1	1.0.1e-1
debian 12	bouncycastle	>=0 <1.48+dfsg-2	1.48+dfsg-2
debian 12	nss	>=0 <2:3.14.3-1	2:3.14.3-1

1-10 of 24

Aliases

1. CVE-2013-01692. NVD-2013-01693. OSV-DEBIAN-2013-01694. OSV-2013-01695. SECURITY-TRACKER-CVE-2013-0169

References

1. https://github.com/wearohat/lucky13

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.