Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2012-4929
HistorySep 15, 2012 - 6:55 p.m.

CVE-2012-4929

2012-09-1518:55:03
CWE-310
[email protected]
web.nvd.nist.gov
9

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.002

Percentile

61.5%

JSON

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a “CRIME” attack.

Affected configurations

Nvd
Node
debiandebian_linuxMatch7.0
OR
debiandebian_linuxMatch8.0
Node
googlechrome
OR
mozillafirefox
VendorProductVersionCPE
debiandebian_linux7.0cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
googlechrome*cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

References

Related

openvas 36
ubuntu 3
nessus 35
debian 8
cve 2
threatpost 1
f5 4
jvn 1
debiancve 1
ibm 3
ubuntucve 2
veracode 1
osv 12
cvelist 2
prion 2
kitploit 1
securityvulns 4
nvd 1
checkpoint_security 1
cert 1
fedora 3
oraclelinux 5
redhat 3
centos 1
amazon 1
gentoo 1
rosalinux 1
openvas
openvas
Ubuntu Update for openssl USN-1898-1
2013-07-05 00:00:00
SUSE: Security Advisory (SUSE-SU-2012:1428-1)
2021-06-09 00:00:00
Debian Security Advisory DSA 2627-1 (nginx - information leak)
2013-02-17 00:00:00
ubuntu
ubuntu
Qt vulnerability
2012-11-08 00:00:00
OpenSSL vulnerability
2013-07-04 00:00:00
Apache HTTP Server vulnerabilities
2012-11-08 00:00:00
nessus
nessus
F5 Networks BIG-IP : CRIME vulnerability via TLS 1.2 protocol (K14054)
2014-10-10 00:00:00
Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : openssl vulnerability (USN-1898-1)
2013-07-05 00:00:00
Ubuntu 10.04 LTS / 11.10 / 12.04 LTS : qt4-x11 vulnerability (USN-1628-1)
2012-11-09 00:00:00
debian
debian
[SECURITY] [DSA 2627-1] nginx security update
2013-02-17 11:14:31
openssl security update
2014-06-20 16:35:50
[SECURITY] [DSA 2579-1] apache2 security update
2012-11-30 13:22:52
cve
cve
CVE-2012-4929
2012-09-15 18:55:03
CVE-2013-3587
2020-02-21 18:15:11
threatpost
threatpost
Apple Patches Mass of Security Bugs in OS X and Safari
2013-06-05 09:51:54
f5
f5
SOL14054 - CRIME vulnerability via TLS 1.2 protocol CVE-2012-4929
2012-12-05 00:00:00
K14054 : CRIME vulnerability via TLS 1.2 protocol CVE-2012-4929
2013-09-09 00:00:00
SOL14059 - CRIME vulnerability via the SPDY protocol CVE-2012-4930
2012-12-19 00:00:00
jvn
jvn
JVN#65273415: Android OS issue where it is affected by the CRIME attack
2016-07-22 00:00:00
debiancve
debiancve
CVE-2012-4929
2012-09-15 18:55:03
ibm
ibm
Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerability in OpenSSL (CVE-2012-4929)
2020-03-03 19:02:20
Security Bulletin: Storwize V7000 Unified Update Includes Fixes for Multiple Vendor Security Vulnerabilities
2022-09-26 04:23:14
Security Bulletin: SONAS Update Includes Fixes for Multiple Vendor Security Vulnerabilities
2022-09-26 04:23:14
ubuntucve
ubuntucve
CVE-2012-4929
2012-09-15 00:00:00
CVE-2013-3587
2020-02-21 00:00:00
veracode
veracode
Information Leakage
2019-01-15 08:58:53
osv
osv
nginx - information leak
2013-02-17 00:00:00
CGA-3gmg-9rq9-3vfp
2024-06-06 12:21:55
links-2.13-1.3 on GA media
2024-06-15 00:00:00
cvelist
cvelist
CVE-2012-4929
2012-09-15 18:00:00
CVE-2013-3587
2020-02-21 17:11:47
prion
prion
Design/Logic Flaw
2012-09-15 18:55:00
Design/Logic Flaw
2020-02-21 18:15:00
kitploit
kitploit
Sitadel - Web Application Security Scanner
2019-01-14 12:13:00
securityvulns
securityvulns
Apache security vulnerabilities
2012-12-02 00:00:00
[SECURITY] [DSA 2579-1] apache2 security update
2012-12-02 00:00:00
Apple Mac OS X multiple security vulnerabilities
2013-06-17 00:00:00
nvd
nvd
CVE-2013-3587
2020-02-21 18:15:11
checkpoint_security
checkpoint_security
Check Point response to CVE-2012-4929, CVE-2012-4930 aka CRIME attack
2012-10-20 22:00:00
cert
cert
BREACH vulnerability in compressed HTTPS
2013-08-02 00:00:00
fedora
fedora
[SECURITY] Fedora 18 Update: mingw-openssl-1.0.1e-1.fc18
2013-04-03 04:51:11
[SECURITY] Fedora 19 Update: Pound-2.6-8.fc19
2014-11-07 02:38:03
[SECURITY] Fedora 20 Update: Pound-2.6-8.fc20
2014-11-12 02:45:18
oraclelinux
oraclelinux
openssl security update
2013-03-04 00:00:00
openssl-fips security update
2015-04-02 00:00:00
openssl security update
2016-09-27 00:00:00
redhat
redhat
(RHSA-2013:0587) Moderate: openssl security update
2013-03-04 00:00:00
(RHSA-2014:0416) Important: rhevm-spice-client security update
2014-04-17 00:00:00
(RHSA-2013:0636) Important: rhev-hypervisor6 security and bug fix update
2013-03-13 00:00:00
centos
centos
openssl security update
2013-03-04 22:46:45
amazon
amazon
Medium: openssl
2013-03-14 22:04:00
gentoo
gentoo
Apache HTTP Server: Multiple vulnerabilities
2013-09-23 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2024-2371
2024-03-12 12:37:38

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.002

Percentile

61.5%

JSON
Related for NVD:CVE-2012-4929
openvas36ubuntu3nessus35debian8cve2threatpost1f54jvn1debiancve1ibm3ubuntucve2veracode1osv12cvelist2prion2kitploit1securityvulns4nvd1checkpoint_security1cert1fedora3oraclelinux5redhat3centos1amazon1gentoo1rosalinux1