Lucene search

K
osvGoogleOSV:DSA-2621-1
HistoryFeb 13, 2013 - 12:00 a.m.

openssl - several vulnerabilities

2013-02-1300:00:00
Google
osv.dev
15

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.007 Low

EPSS

Percentile

77.2%

Multiple vulnerabilities have been found in OpenSSL. The Common
Vulnerabilities and Exposures project identifies the following issues:

  • CVE-2013-0166
    OpenSSL does not properly perform signature verification for OCSP
    responses, which allows remote attackers to cause a denial of
    service via an invalid key.
  • CVE-2013-0169
    A timing side channel attack has been found in CBC padding
    allowing an attacker to recover pieces of plaintext via statistical
    analysis of crafted packages, known as the Lucky Thirteen issue.

For the stable distribution (squeeze), these problems have been fixed in
version 0.9.8o-4squeeze14.

For the testing distribution (wheezy), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in
version 1.0.1e-1.

We recommend that you upgrade your openssl packages.

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.007 Low

EPSS

Percentile

77.2%