Lucene search
MitreCVE-2013-1619HistoryFeb 08, 2013 - 7:55 p.m.
CVE-2013-1619
2013-02-0819:55:01
CWE-310
mitre
web.nvd.nist.gov
72
cve-2013-1619
gnutls
tls implementation
timing side-channel attacks
cbc padding
remote attackers
plaintext-recovery attacks
statistical analysis
CVSS2
4
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:P/A:N
AI Score
6.8
Confidence
High
EPSS
0.005
Percentile
77.3%
The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Affected configurations
Node
gnugnutlsMatch2.0.0
ORgnugnutlsMatch2.0.1
ORgnugnutlsMatch2.0.2
ORgnugnutlsMatch2.0.3
ORgnugnutlsMatch2.0.4
ORgnugnutlsMatch2.1.0
ORgnugnutlsMatch2.1.1
ORgnugnutlsMatch2.1.2
ORgnugnutlsMatch2.1.3
ORgnugnutlsMatch2.1.4
ORgnugnutlsMatch2.1.5
ORgnugnutlsMatch2.1.6
ORgnugnutlsMatch2.1.7
ORgnugnutlsMatch2.1.8
ORgnugnutlsMatch2.2.0
ORgnugnutlsMatch2.2.1
ORgnugnutlsMatch2.2.2
ORgnugnutlsMatch2.2.3
ORgnugnutlsMatch2.2.4
ORgnugnutlsMatch2.2.5
ORgnugnutlsMatch2.3.0
ORgnugnutlsMatch2.3.1
ORgnugnutlsMatch2.3.2
ORgnugnutlsMatch2.3.3
ORgnugnutlsMatch2.3.4
ORgnugnutlsMatch2.3.5
ORgnugnutlsMatch2.3.6
ORgnugnutlsMatch2.3.7
ORgnugnutlsMatch2.3.8
ORgnugnutlsMatch2.3.9
ORgnugnutlsMatch2.3.10
ORgnugnutlsMatch2.3.11
ORgnugnutlsMatch2.4.0
ORgnugnutlsMatch2.4.1
ORgnugnutlsMatch2.4.2
ORgnugnutlsMatch2.4.3
ORgnugnutlsMatch2.5.0
ORgnugnutlsMatch2.6.0
ORgnugnutlsMatch2.6.1
ORgnugnutlsMatch2.6.2
ORgnugnutlsMatch2.6.3
ORgnugnutlsMatch2.6.4
ORgnugnutlsMatch2.6.5
ORgnugnutlsMatch2.6.6
ORgnugnutlsMatch2.7.4
ORgnugnutlsMatch2.8.0
ORgnugnutlsMatch2.8.1
ORgnugnutlsMatch2.8.2
ORgnugnutlsMatch2.8.3
ORgnugnutlsMatch2.8.4
ORgnugnutlsMatch2.8.5
ORgnugnutlsMatch2.8.6
ORgnugnutlsMatch2.10.0
ORgnugnutlsMatch2.10.1
ORgnugnutlsMatch2.10.2
ORgnugnutlsMatch2.10.3
ORgnugnutlsMatch2.10.4
ORgnugnutlsMatch2.10.5
ORgnugnutlsMatch2.12.0
ORgnugnutlsMatch2.12.1
ORgnugnutlsMatch2.12.2
ORgnugnutlsMatch2.12.3
ORgnugnutlsMatch2.12.4
ORgnugnutlsMatch2.12.5
ORgnugnutlsMatch2.12.6
ORgnugnutlsMatch2.12.6.1
ORgnugnutlsMatch2.12.7
ORgnugnutlsMatch2.12.8
ORgnugnutlsMatch2.12.9
ORgnugnutlsMatch2.12.10
ORgnugnutlsMatch2.12.11
ORgnugnutlsMatch2.12.12
ORgnugnutlsMatch2.12.13
ORgnugnutlsMatch2.12.14
ORgnugnutlsMatch2.12.15
ORgnugnutlsMatch2.12.16
ORgnugnutlsMatch2.12.17
ORgnugnutlsMatch2.12.18
ORgnugnutlsMatch2.12.19
ORgnugnutlsMatch2.12.20
ORgnugnutlsMatch2.12.21
ORgnugnutlsMatch2.12.22
Node
gnugnutlsMatch3.0
ORgnugnutlsMatch3.0.0
ORgnugnutlsMatch3.0.1
ORgnugnutlsMatch3.0.2
ORgnugnutlsMatch3.0.3
ORgnugnutlsMatch3.0.4
ORgnugnutlsMatch3.0.5
ORgnugnutlsMatch3.0.6
ORgnugnutlsMatch3.0.7
ORgnugnutlsMatch3.0.8
ORgnugnutlsMatch3.0.9
ORgnugnutlsMatch3.0.10
ORgnugnutlsMatch3.0.11
ORgnugnutlsMatch3.0.12
ORgnugnutlsMatch3.0.13
ORgnugnutlsMatch3.0.14
ORgnugnutlsMatch3.0.15
ORgnugnutlsMatch3.0.16
ORgnugnutlsMatch3.0.17
ORgnugnutlsMatch3.0.18
ORgnugnutlsMatch3.0.19
ORgnugnutlsMatch3.0.20
ORgnugnutlsMatch3.0.21
ORgnugnutlsMatch3.0.22
ORgnugnutlsMatch3.0.23
ORgnugnutlsMatch3.0.24
ORgnugnutlsMatch3.0.25
ORgnugnutlsMatch3.0.26
ORgnugnutlsMatch3.0.27
Node
gnugnutlsMatch3.1.0
ORgnugnutlsMatch3.1.1
ORgnugnutlsMatch3.1.2
ORgnugnutlsMatch3.1.3
ORgnugnutlsMatch3.1.4
ORgnugnutlsMatch3.1.5
ORgnugnutlsMatch3.1.6
| Vendor | Product | Version | CPE |
|---|---|---|---|
| gnu | gnutls | 2.0.0 | cpe:2.3:a:gnu:gnutls:2.0.0:*:*:*:*:*:*:* |
| gnu | gnutls | 2.0.1 | cpe:2.3:a:gnu:gnutls:2.0.1:*:*:*:*:*:*:* |
| gnu | gnutls | 2.0.2 | cpe:2.3:a:gnu:gnutls:2.0.2:*:*:*:*:*:*:* |
| gnu | gnutls | 2.0.3 | cpe:2.3:a:gnu:gnutls:2.0.3:*:*:*:*:*:*:* |
| gnu | gnutls | 2.0.4 | cpe:2.3:a:gnu:gnutls:2.0.4:*:*:*:*:*:*:* |
| gnu | gnutls | 2.1.0 | cpe:2.3:a:gnu:gnutls:2.1.0:*:*:*:*:*:*:* |
| gnu | gnutls | 2.1.1 | cpe:2.3:a:gnu:gnutls:2.1.1:*:*:*:*:*:*:* |
| gnu | gnutls | 2.1.2 | cpe:2.3:a:gnu:gnutls:2.1.2:*:*:*:*:*:*:* |
| gnu | gnutls | 2.1.3 | cpe:2.3:a:gnu:gnutls:2.1.3:*:*:*:*:*:*:* |
| gnu | gnutls | 2.1.4 | cpe:2.3:a:gnu:gnutls:2.1.4:*:*:*:*:*:*:* |
References
lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html
lists.opensuse.org/opensuse-security-announce/2014-03/msg00009.html
lists.opensuse.org/opensuse-updates/2013-05/msg00023.html
nmav.gnutls.org/2013/02/time-is-money-for-cbc-ciphersuites.html
openwall.com/lists/oss-security/2013/02/05/24
rhn.redhat.com/errata/RHSA-2013-0588.html
secunia.com/advisories/57260
secunia.com/advisories/57274
www.gnutls.org/security.html#GNUTLS-SA-2013-1
www.isg.rhul.ac.uk/tls/TLStiming.pdf
www.ubuntu.com/usn/USN-1752-1
gitorious.org/gnutls/gnutls/commit/328ee22c1b3951e060c7124c7cb1cee592c59bc0
gitorious.org/gnutls/gnutls/commit/b8391806cd79095fe566f2401d8c7ad85a64b198
Related
ubuntucve
ubuntucve
f5
f5
SOL15721 - GnuTLS vulnerability CVE-2013-1619
2014-10-23 00:00:00
K15721 : GnuTLS vulnerability CVE-2013-1619
2014-10-23 00:00:00
K14190 : TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169
2015-04-30 00:00:00
nvd
nvd
prion
prion
Design/Logic Flaw
2013-02-08 19:55:00
Design/Logic Flaw
2013-02-08 19:55:00
Design/Logic Flaw
2013-02-08 19:55:00
debiancve
debiancve
cvelist
cvelist
openvas
openvas
Fedora Update for mingw-gnutls FEDORA-2013-2128
2013-02-18 00:00:00
Fedora Update for mingw-gnutls FEDORA-2013-3453
2013-03-15 00:00:00
Fedora Update for mingw-gnutls FEDORA-2013-2110
2013-02-18 00:00:00
fedora
fedora
[SECURITY] Fedora 17 Update: gnutls-2.12.23-1.fc17
2013-03-12 23:33:08
[SECURITY] Fedora 18 Update: gnutls-2.12.23-1.fc18
2013-03-05 23:27:08
[SECURITY] Fedora 17 Update: libtasn1-2.14-1.fc17
2013-03-12 23:33:08
centos
centos
gnutls security update
2013-03-04 22:46:23
gnutls security update
2013-05-30 18:50:13
java security update
2013-02-20 20:11:32
nessus
nessus
Amazon Linux AMI : gnutls (ALAS-2013-172)
2013-09-04 00:00:00
Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : gnutls13, gnutls26 vulnerability (USN-1752-1)
2013-02-28 00:00:00
Slackware 14.0 / current : gnutls (SSA:2013-242-01)
2013-09-02 00:00:00
slackware
slackware
[slackware-security] gnutls
2013-08-30 07:46:14
[slackware-security] gnutls
2013-08-30 20:25:45
[slackware-security] gnutls
2013-10-15 00:18:30
amazon
amazon
Medium: gnutls
2013-03-14 22:04:00
Important: gnutls
2013-06-11 22:44:00
oraclelinux
oraclelinux
gnutls security update
2013-03-04 00:00:00
gnutls security update
2013-05-30 00:00:00
gnutls security update
2014-03-03 00:00:00
veracode
veracode
Information Leakage
2019-01-15 08:58:55
Timing Attacks
2017-02-10 05:59:15
Timing Side- Channel Attack
2019-01-15 08:52:54
securityvulns
securityvulns
[USN-1752-1] GnuTLS vulnerability
2013-03-02 00:00:00
OpenSSL / PolarSSL / GnuTLS security vulnerabilities
2013-03-02 00:00:00
ubuntu
ubuntu
GnuTLS vulnerability
2013-02-27 00:00:00
redhat
redhat
(RHSA-2013:0588) Moderate: gnutls security update
2013-03-04 00:00:00
(RHSA-2013:0883) Important: gnutls security update
2013-05-30 00:00:00
(RHSA-2013:0636) Important: rhev-hypervisor6 security and bug fix update
2013-03-13 00:00:00
gentoo
gentoo
GnuTLS: Multiple vulnerabilities
2013-10-28 00:00:00
suse
suse
gnutls (critical)
2014-03-08 19:04:13
Security update for gnutls (critical)
2014-03-04 01:07:15
Security update for gnutls (critical)
2014-03-04 01:04:52
ibm
ibm
Security Bulletin: Java Vulnerability in Rational Automation Framework (CVE-2013-0169)
2018-06-17 04:48:04
Security Bulletin: Potential security vulnerabilities in WebSphere Partner Gateway Express for the Oracle CPU April 2013.
2022-09-25 21:06:56
Security Bulletin: Rational Build Forge Security Advisory (CVE-2013-0169)
2018-06-17 04:47:31
openssl
openssl
Vulnerability in OpenSSL - SSL, TLS and DTLS Plaintext Recovery Attack
2013-02-04 00:00:00
pentestpartners
pentestpartners
Vulnerabilities that (mostly) aren’t: LUCKY13
2024-05-03 05:12:27
hackerone
hackerone
Legal Robot: LUCKY13 (CVE-2013-0169) effects legalrobot.com
2017-07-30 20:00:47
cve
cve
CVE-2013-0169
2013-02-08 19:55:01
CVE-2013-1623
2013-02-08 19:55:01
altlinux
altlinux
Security fix for the ALT Linux 9 package openssl1.1 version 1.0.0k-alt1
2013-02-27 00:00:00
Security fix for the ALT Linux 9 package openssl10 version 1.0.0k-alt1
2013-02-27 00:00:00
Security fix for the ALT Linux 7 package openssl10 version 1.0.0k-alt1
2013-02-27 00:00:00
freebsd
freebsd
FreeBSD -- OpenSSL multiple vulnerabilities
2013-04-02 00:00:00
osv
osv
CVE-2016-2107
2016-05-05 01:59:00
Improper Input Validation in Bouncy Castle
2022-05-14 02:14:04
CVSS2
4
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:P/I:P/A:N
AI Score
6.8
Confidence
High
EPSS
0.005
Percentile
77.3%
Related for CVE-2013-1619