DEBIAN-CVE-2013-0169
Record from OSV · Published February 8, 2013
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| bouncycastle | Debian:13 | 1.48+dfsg-2 |
| bouncycastle | Debian:14 | 1.48+dfsg-2 |
| openssl | Debian:14 | 1.0.1e-1 |
| openssl | Debian:13 | 1.0.1e-1 |
| openssl | Debian:12 | 1.0.1e-1 |
| nss | Debian:14 | 2:3.14.3-1 |
| nss | Debian:13 | 2:3.14.3-1 |
| gnutls28 | Debian:14 | 3.0.22-3 |
| gnutls28 | Debian:13 | 3.0.22-3 |
| bouncycastle | Debian:12 | 1.48+dfsg-2 |
| gnutls28 | Debian:12 | 3.0.22-3 |
| nss | Debian:12 | 2:3.14.3-1 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | bouncycastle | 0 |
| Debian:14 | bouncycastle | 0 |
| Debian:14 | openssl | 0 |
| Debian:13 | openssl | 0 |
| Debian:12 | openssl | 0 |
| Debian:14 | nss | 0 |
| Debian:13 | nss | 0 |
| Debian:14 | gnutls28 | 0 |
| Debian:13 | gnutls28 | 0 |
| Debian:12 | bouncycastle | 0 |
| Debian:12 | gnutls28 | 0 |
| Debian:12 | nss | 0 |
Timeline
- Feb 8, 2013 CVE Published
- Apr 11, 2025 PoC Published
- Sep 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2013-0169
vulnetix vdb fixes DEBIAN-CVE-2013-0169Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2013-0169/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart