CVE-2013-1620

Fixed in a distro release EPSS 4%

The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

Published 2013-02-08 · CVE record · OSV

Products: mozilla network_security_services, canonical ubuntu_linux, oracle enterprise_manager_ops_center, oracle glassfish_communications_server, oracle glassfish_server, oracle iplanet_web_proxy_server, oracle iplanet_web_server, oracle opensso, oracle traffic_director, oracle vm_server, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_workstation

Distro releases