Skip to content
Fencer Intel
low 2.6

CVE-2013-0169 json

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly…

published 2013-02-08 13 y ago modified 2026-06-16 4 mo ago also EUVD-2013-0208

cvss
2.6
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
35.6%
EPSS 35.6% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

Patch / fix

  • nss Debian 14, Debian 13, Debian 12 2:3.14.3-1
  • openssl Debian 14, Debian 13, Debian 12 1.0.1e-1
  • gnutls28 Debian 14, Debian 13, Debian 12 3.0.22-3
  • bouncycastle Debian 14, Debian 13, Debian 12 1.48+dfsg-2

debian advisories DEBIAN-CVE-2013-0169

  • openssl098 Ubuntu 14.04 LTS 0.9.8o-7ubuntu3.2.14.04.1

ubuntu advisories UBUNTU-CVE-2013-0169

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • java-1.6.0-ibm network satellite 5.5, network satellite 5.4 1:1.6.0.14.0-1jpp.1.el5_9
  • java-1.6.0-ibm network satellite 5.5, network satellite 5.4 1:1.6.0.14.0-1jpp.1.el6_4
  • java-1.7.0-ibm RHEL 5 EXTRAS 1:1.7.0.4.2-1jpp.1.el5_9
  • java-1.7.0-ibm RHEL 6 EXTRAS 1:1.7.0.4.2-1jpp.1.el6_4
  • java-1.7.0-ibm-src RHEL 5 EXTRAS 1:1.7.0.4.2-1jpp.1.el5_9
  • java-1.7.0-ibm-src RHEL 6 EXTRAS 1:1.7.0.4.2-1jpp.1.el6_4
  • java-1.7.0-ibm-demo RHEL 5 EXTRAS 1:1.7.0.4.2-1jpp.1.el5_9
  • java-1.7.0-ibm-demo RHEL 6 EXTRAS 1:1.7.0.4.2-1jpp.1.el6_4

red hat advisories RHSA-2013:1456RHSA-2013:1455RHSA-2013:0822RHSA-2014:0416RHSA-2013:0823RHSA-2013:0855

  • libqt4 SLES 12 SP1, SLES 12, SLED 12 SP1 +7 more 4.8.6-7.1
  • libqt4-sql-plugins SLES 12 SP1, SLES 12, SLED 12 SP1 +7 more 4.8.6-7.1

suse advisories SUSE-SU-403SUSE-SU-403 Forbidden-1

  • java-1_7_0-openjdk openSUSE Tumbleweed 1.7.0.121-1.1
  • openssl-1_1 openSUSE Tumbleweed 1.1.1l-1.2

opensuse advisories openSUSE-SU-2024:10534-1openSUSE-SU-2024:11127-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-0169 updated cvss 5.1

SSL/TLS: CBC padding timing attack (lucky-13)

  • Red Hat Enterprise Linux 5 openssl097a Red Hat Enterprise Linux 6 openssl098e Red Hat JBoss Enterprise Web Server 1 openssl Red Hat OpenShift Container Platform 3.11 haproxy, haproxy18
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux (v. 5 server) openssl 0.9.8e-26.el5_9.1, openssl-perl 0.9.8e-26.el5_9.1, java-1.7.0-openjdk 1.7.0.9-2.3.7.1.el5_9, java-1.6.0-openjdk 1.6.0.0-1.35.1.11.8.el5_9, java-1.7.0-openjdk-src 1.7.0.9-2.3.7.1.el5_9, java-1.7.0-openjdk-demo 1.7.0.9-2.3.7.1.el5_9, +4 more
    fixed: vendor fix RHSA-2013:0274
  • Red Hat Enterprise Linux Desktop (v. 6) openssl 1.0.0-27.el6_4.2, java-1.7.0-openjdk 1.7.0.9-2.3.7.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.56.1.11.8.el6_3 Red Hat Enterprise Linux Desktop Optional (v. 6) openssl 1.0.0-27.el6_4.2, openssl-perl 1.0.0-27.el6_4.2, java-1.7.0-openjdk 1.7.0.9-2.3.7.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.56.1.11.8.el6_3, java-1.7.0-openjdk-src 1.7.0.9-2.3.7.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.9-2.3.7.1.el6_3, +4 more
    fixed: vendor fix RHSA-2013:0275
  • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.6.0-sun 1.6.0.41-1jpp.1.el6_3, java-1.7.0-ibm 1.7.0.4.2-1jpp.1.el6_4, java-1.5.0-ibm 1.5.0.16.2-1jpp.1.el6_4, java-1.6.0-ibm 1.6.0.13.2-1jpp.1.el6_4, java-1.7.0-oracle 1.7.0.15-1jpp.1.el6_3, java-1.6.0-sun-src 1.6.0.41-1jpp.1.el6_3, +21 more
    fixed: vendor fix RHSA-2013:0855
  • Red Hat Enterprise Linux HPC Node (v. 6) openssl 1.0.0-27.el6_4.2, java-1.7.0-openjdk 1.7.0.9-2.3.7.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.56.1.11.8.el6_3 Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl 1.0.0-27.el6_4.2, openssl-perl 1.0.0-27.el6_4.2, java-1.7.0-openjdk 1.7.0.9-2.3.7.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.56.1.11.8.el6_3, java-1.7.0-openjdk-src 1.7.0.9-2.3.7.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.9-2.3.7.1.el6_3, +4 more
    fixed: vendor fix RHSA-2013:0275
  • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.6.0-sun 1.6.0.41-1jpp.1.el6_3, java-1.7.0-ibm 1.7.0.4.2-1jpp.1.el6_4, java-1.5.0-ibm 1.5.0.16.2-1jpp.1.el6_4, java-1.6.0-ibm 1.6.0.13.2-1jpp.1.el6_4, java-1.7.0-oracle 1.7.0.15-1jpp.1.el6_3, java-1.6.0-sun-src 1.6.0.41-1jpp.1.el6_3, +11 more
    fixed: vendor fix RHSA-2013:0855
  • Red Hat Enterprise Linux Server (v. 6) openssl 1.0.0-27.el6_4.2, java-1.7.0-openjdk 1.7.0.9-2.3.7.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.56.1.11.8.el6_3, java-1.6.0-openjdk-javadoc 1.6.0.0-1.56.1.11.8.el6_3 Red Hat Enterprise Linux Server Optional (v. 6) openssl 1.0.0-27.el6_4.2, openssl-perl 1.0.0-27.el6_4.2, java-1.7.0-openjdk 1.7.0.9-2.3.7.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.56.1.11.8.el6_3, java-1.7.0-openjdk-src 1.7.0.9-2.3.7.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.9-2.3.7.1.el6_3, +3 more
    fixed: vendor fix RHSA-2013:0275
  • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-sun 1.6.0.41-1jpp.1.el5_9, java-1.7.0-ibm 1.7.0.4.2-1jpp.1.el5_9, java-1.5.0-ibm 1.5.0.16.2-1jpp.1.el5_9, java-1.6.0-ibm 1.6.0.13.2-1jpp.1.el5_9, java-1.7.0-oracle 1.7.0.15-1jpp.1.el5_9, java-1.6.0-sun-src 1.6.0.41-1jpp.1.el5_9, +23 more Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.6.0-sun 1.6.0.41-1jpp.1.el6_3, java-1.7.0-ibm 1.7.0.4.2-1jpp.1.el6_4, java-1.5.0-ibm 1.5.0.16.2-1jpp.1.el6_4, java-1.6.0-ibm 1.6.0.13.2-1jpp.1.el6_4, java-1.7.0-oracle 1.7.0.15-1jpp.1.el6_3, java-1.6.0-sun-src 1.6.0.41-1jpp.1.el6_3, +21 more
    fixed: vendor fix RHSA-2013:0855
show 12 more
  • Red Hat Enterprise Linux Workstation (v. 6) openssl 1.0.0-27.el6_4.2, java-1.7.0-openjdk 1.7.0.9-2.3.7.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.56.1.11.8.el6_3, java-1.6.0-openjdk-javadoc 1.6.0.0-1.56.1.11.8.el6_3 Red Hat Enterprise Linux Workstation Optional (v. 6) openssl 1.0.0-27.el6_4.2, openssl-perl 1.0.0-27.el6_4.2, java-1.7.0-openjdk 1.7.0.9-2.3.7.1.el6_3, java-1.6.0-openjdk 1.6.0.0-1.56.1.11.8.el6_3, java-1.7.0-openjdk-src 1.7.0.9-2.3.7.1.el6_3, java-1.7.0-openjdk-demo 1.7.0.9-2.3.7.1.el6_3, +3 more
    fixed: vendor fix RHSA-2013:0275
  • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.6.0-sun 1.6.0.41-1jpp.1.el6_3, java-1.7.0-ibm 1.7.0.4.2-1jpp.1.el6_4, java-1.5.0-ibm 1.5.0.16.2-1jpp.1.el6_4, java-1.6.0-ibm 1.6.0.13.2-1jpp.1.el6_4, java-1.7.0-oracle 1.7.0.15-1jpp.1.el6_3, java-1.6.0-sun-src 1.6.0.41-1jpp.1.el6_3, +21 more
    fixed: vendor fix RHSA-2013:0855
  • Red Hat JBoss Enterprise Application Platform 5.2
    fixed: vendor fix RHSA-2013:0783
  • Red Hat JBoss Enterprise Application Platform 6.1
    fixed: vendor fix RHSA-2013:0833
  • Red Hat JBoss Web Platform 5.2
    fixed: vendor fix RHSA-2013:0782
  • Red Hat JBoss Web Server 2.0
    fixed: vendor fix RHSA-2013:1013
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-kube-rbac-proxy v4.6.0-202010061132.p0
    fixed: vendor fix RHSA-2020:4298
  • Red Hat Satellite 5.4 (RHEL v.5) java-1.6.0-ibm 1.6.0.14.0-1jpp.1.el5_9 Red Hat Satellite 5.4 (RHEL v.6) java-1.6.0-ibm 1.6.0.14.0-1jpp.1.el6_4
    fixed: vendor fix RHSA-2013:1455
  • Red Hat Satellite 5.5 (RHEL v.5) java-1.6.0-ibm 1.6.0.14.0-1jpp.1.el5_9 Red Hat Satellite 5.5 (RHEL v.6) java-1.6.0-ibm 1.6.0.14.0-1jpp.1.el6_4
    fixed: vendor fix RHSA-2013:1456
  • Red Hat RHEV Hypervisor for RHEL-6 rhev-hypervisor6 6.4-20130306.2.el6_4
    fixed: vendor fix RHSA-2013:0636
  • Red Hat RHEV-M 3.3 rhevm-spice-client 3.3-12.el6_5, rhevm-spice-client-x64-cab 3.3-12.el6_5, rhevm-spice-client-x64-msi 3.3-12.el6_5, rhevm-spice-client-x86-cab 3.3-12.el6_5, rhevm-spice-client-x86-msi 3.3-12.el6_5
    fixed: vendor fix RHSA-2014:0416
  • Red Hat OpenShift Container Platform 4 haproxy, haproxy18, haproxy20, haproxy22, haproxy26, haproxy28 Red Hat OpenShift Container Platform 4.6 openshift4/ose-cli v4.6.0-202010080605.p0, openshift4/ose-ptp v4.6.0-202010200139.p0, openshift4/ose-etcd v4.6.0-202010061132.p0, openshift4/ose-tests v4.6.0-202010120952.p0, openshift4/ose-console v4.6.0-202010100121.p0, openshift4/ose-coredns v4.6.0-202010061132.p0, +79 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-105-08 updated cvss 6.5

ABB M2M Gateway

  • ABB M2M Gateway >=4.1.2, <=5.0.3, >=5.0.1, <=5.0.3
    affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-097-01 updated cvss 3.7

Pepperl+Fuchs WirelessHART-Gateway

  • Pepperl+Fuchs WHA-GW-F2D2-0-AS- Z2-ETH 3.0.7, 3.0.8, 3.0.9 Pepperl+Fuchs WHA-GW-F2D2-0-AS- Z2-ETH.EIP 3.0.7, 3.0.8, 3.0.9
    affected: mitigation “Minimize network exposure for affected products and ensure they are not accessible via the Internet.” cert.vde.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-19-192-04 updated cvss 5.9

ICSA-19-192-04 Siemens SIMATIC RF6XXR

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

35.58% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.