CVE-2013-3587

The HTTPS protocol, as used in unspecified web applications, can encrypt
compressed data without properly obfuscating the length of the unencrypted
data, which makes it easier for man-in-the-middle attackers to obtain
plaintext secret values by observing length differences during a series of
guesses in which a string in an HTTP request URL potentially matches an
unknown string in an HTTP response body, aka a “BREACH” attack, a different
issue than CVE-2012-4929.

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=995168&gt;
• <https://bugzilla.novell.com/show_bug.cgi?id=833754&gt;

Notes