The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 1 | java-1.6.0-openjdk | 2013-03-02 16:50 | ALAS-2013-163 |
Amazon Linux 1 | java-1.7.0-openjdk | 2013-03-02 16:49 | ALAS-2013-162 |
Amazon Linux 1 | openssl | 2013-03-14 22:04 | ALAS-2013-171 |
Amazon Linux 1 | openssl | 2014-04-07 17:26 | ALAS-2014-320 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv2 | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P |
NVD | CVSSv2 | 2.6 | AV:N/AC:H/Au:N/C:P/I:N/A:N |