VDB
DEBIAN-CVE-2013-0169
DEBIAN-CVE-2013-0169
PUBLISHED
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | bouncycastle | 0, 0, 0 |
| Debian:14 | bouncycastle | 0, 0, 0 |
| Debian:14 | openssl | 0, 0, 0 |
| Debian:13 | openssl | 0, 0, 0 |
| Debian:11 | nss | 0, 0, 0 |
| Debian:12 | openssl | 0, 0, 0 |
| Debian:11 | bouncycastle | 0, 0, 0 |
| Debian:14 | nss | 0, 0, 0 |
| Debian:13 | nss | 0, 0, 0 |
| Debian:14 | gnutls28 | 0, 0, 0 |
| Debian:13 | gnutls28 | 0, 0, 0 |
| Debian:12 | bouncycastle | 0, 0, 0 |
| Debian:11 | openssl | 0, 0, 0 |
| Debian:12 | gnutls28 | 0, 0, 0 |
| Debian:12 | nss | 0, 0, 0 |
| Debian:11 | gnutls28 | 0, 0, 0 |
Timeline
- Feb 8, 2013 CVE Published
- Apr 11, 2025 PoC Published
- Apr 28, 2026 CVE Updated