CVE-2003-0131

2003-03-2405:00:00

[email protected]

web.nvd.nist.gov

openssl

ssl

tls

cve-2003-0131

unauthorized access

rsa

bleichenbacher attack

klima-pokorny-rosa attack

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9 High

AI Score

Confidence

High

0.074 Low

EPSS

Percentile

94.1%

JSON

The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the “Klima-Pokorny-Rosa attack.”

Affected configurations

NVD

Node

opensslopensslMatch0.9.6

opensslopensslMatch0.9.6a

opensslopensslMatch0.9.6b

opensslopensslMatch0.9.6c

opensslopensslMatch0.9.6d

opensslopensslMatch0.9.6e

opensslopensslMatch0.9.6g

opensslopensslMatch0.9.6h

opensslopensslMatch0.9.6i

opensslopensslMatch0.9.7

opensslopensslMatch0.9.7a

CPENameOperatorVersion
openssl:opensslopenssleq0.9.6
openssl:opensslopenssleq0.9.6a
openssl:opensslopenssleq0.9.6b
openssl:opensslopenssleq0.9.6c
openssl:opensslopenssleq0.9.6d
openssl:opensslopenssleq0.9.6e
openssl:opensslopenssleq0.9.6g
openssl:opensslopenssleq0.9.6h
openssl:opensslopenssleq0.9.6i
openssl:opensslopenssleq0.9.7

CPE	Name	Operator	Version
openssl:openssl	openssl	eq	0.9.6
openssl:openssl	openssl	eq	0.9.6a
openssl:openssl	openssl	eq	0.9.6b
openssl:openssl	openssl	eq	0.9.6c
openssl:openssl	openssl	eq	0.9.6d
openssl:openssl	openssl	eq	0.9.6e
openssl:openssl	openssl	eq	0.9.6g
openssl:openssl	openssl	eq	0.9.6h
openssl:openssl	openssl	eq	0.9.6i
openssl:openssl	openssl	eq	0.9.7