Lucene search

K
f5F5F5:K15721
HistoryOct 23, 2014 - 12:00 a.m.

K15721 : GnuTLS vulnerability CVE-2013-1619

2014-10-2300:00:00
my.f5.com
8

AI Score

7.1

Confidence

High

EPSS

0.005

Percentile

77.3%

Security Advisory Description

The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. (CVE-2013-1619)

Impact

None. No F5 products are affected by this vulnerability.

Note: F5 Product Development has determined that BIG-IP, BIG-IQ, and Enterprise Manager versions ship with vulnerable GnuTLS code. However, the vulnerable code is not used as a server or to make outgoing connections, and is not exploitable.