CVE-2013-1624
08.02.2013, 19:55
The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.Enginsight
| Vendor | Product | Version |
|---|---|---|
| bouncycastle | bc-java | 1.01 |
| bouncycastle | bc-java | 1.02 |
| bouncycastle | bc-java | 1.03 |
| bouncycastle | bc-java | 1.04 |
| bouncycastle | bc-java | 1.05 |
| bouncycastle | bc-java | 1.06 |
| bouncycastle | bc-java | 1.07 |
| bouncycastle | bc-java | 1.08 |
| bouncycastle | bc-java | 1.09 |
| bouncycastle | bc-java | 1.10 |
| bouncycastle | bc-java | 1.11 |
| bouncycastle | bc-java | 1.12 |
| bouncycastle | bc-java | 1.13 |
| bouncycastle | bc-java | 1.14 |
| bouncycastle | bc-java | 1.15 |
| bouncycastle | bc-java | 1.16 |
| bouncycastle | bc-java | 1.17 |
| bouncycastle | bc-java | 1.18 |
| bouncycastle | bc-java | 1.19 |
| bouncycastle | bc-java | 1.20 |
| bouncycastle | bc-java | 1.21 |
| bouncycastle | bc-java | 1.22 |
| bouncycastle | bc-java | 1.23 |
| bouncycastle | bc-java | 1.24 |
| bouncycastle | bc-java | 1.25 |
| bouncycastle | bc-java | 1.26 |
| bouncycastle | bc-java | 1.27 |
| bouncycastle | bc-java | 1.28 |
| bouncycastle | bc-java | 1.29 |
| bouncycastle | bc-java | 1.30 |
| bouncycastle | bc-java | 1.31 |
| bouncycastle | bc-java | 1.32 |
| bouncycastle | bc-java | 1.33 |
| bouncycastle | bc-java | 1.34 |
| bouncycastle | bc-java | 1.35 |
| bouncycastle | bc-java | 1.36 |
| bouncycastle | bc-java | 1.37 |
| bouncycastle | bc-java | 1.38 |
| bouncycastle | bc-java | 1.39 |
| bouncycastle | bc-java | 1.40 |
| bouncycastle | bc-java | 1.41 |
| bouncycastle | bc-java | 1.42 |
| bouncycastle | bc-java | 1.43 |
| bouncycastle | bc-java | 1.44 |
| bouncycastle | bc-java | 1.45 |
| bouncycastle | bc-java | 1.46 |
| bouncycastle | bc-java | 1.47 |
| bouncycastle | legion-of-the-bouncy-castle-c\#-cryptography-api | 0.0 |
| bouncycastle | legion-of-the-bouncy-castle-c\#-cryptography-api | 1.0 |
| bouncycastle | legion-of-the-bouncy-castle-c\#-cryptography-api | 1.1 |
| bouncycastle | legion-of-the-bouncy-castle-c\#-cryptography-api | 1.2 |
| bouncycastle | legion-of-the-bouncy-castle-c\#-cryptography-api | 1.3 |
| bouncycastle | legion-of-the-bouncy-castle-c\#-cryptography-api | 1.4 |
| bouncycastle | legion-of-the-bouncy-castle-c\#-cryptography-api | 1.5 |
| bouncycastle | legion-of-the-bouncy-castle-c\#-cryptography-api | 1.6.1 |
| bouncycastle | legion-of-the-bouncy-castle-c\#-cryptography-api | 1.7 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References