CVE-2013-0169

Name	CVE-2013-0169
Description	The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DSA-2621-1, DSA-2622-1
Debian Bugs	699885, 699887, 699888, 699889

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
bouncycastle (PTS)	jessie, jessie (lts)	1.49+dfsg-3+deb8u3	fixed
	stretch (security), stretch (lts), stretch	1.56-1+deb9u3	fixed
	buster	1.60-1	fixed
	bullseye	1.68-2	fixed
	sid, bookworm	1.71-1	fixed
gnutls28 (PTS)	jessie, jessie (lts)	3.3.30-0+deb8u2	fixed
	stretch (security), stretch (lts), stretch	3.5.8-5+deb9u6	fixed
	buster	3.6.7-4+deb10u8	fixed
	buster (security)	3.6.7-4+deb10u9	fixed
	bullseye (security), bullseye	3.7.1-5+deb11u2	fixed
	sid, bookworm	3.7.8-4	fixed
nss (PTS)	jessie, jessie (lts)	2:3.26-1+debu8u16	fixed
	stretch (security), stretch (lts), stretch	2:3.26.2-1.1+deb9u5	fixed
	buster, buster (security)	2:3.42.1-1+deb10u5	fixed
	bullseye (security), bullseye	2:3.61-1+deb11u2	fixed
	sid, bookworm	2:3.85-1	fixed
openjdk-7 (PTS)	jessie, jessie (lts)	7u321-2.6.28-0+deb8u1	fixed
openssl (PTS)	jessie, jessie (lts)	1.0.1t-1+deb8u19	fixed
	stretch (security)	1.1.0l-1~deb9u6	fixed
	stretch (lts), stretch	1.1.0l-1~deb9u7	fixed
	buster, buster (security)	1.1.1n-0+deb10u3	fixed
	bullseye (security), bullseye	1.1.1n-0+deb11u3	fixed
	sid, bookworm	3.0.7-1	fixed
polarssl (PTS)	jessie, jessie (lts)	1.3.9-2.1+deb8u4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
bouncycastle	source	(unstable)	1.48+dfsg-2	low		699885
cyassl	source	(unstable)	2.9.4+dfsg-1
gnutls26	source	(unstable)	2.12.20-4
gnutls28	source	(unstable)	3.0.22-3
matrixssl	source	(unstable)	(unfixed)	low
nss	source	(unstable)	2:3.14.3-1			699888
openjdk-6	source	(unstable)	6b27-1.12.3-1
openjdk-7	source	(unstable)	7u3-2.1.6-1
openssl	source	squeeze	0.9.8o-4squeeze14		DSA-2621-1
openssl	source	(unstable)	1.0.1e-1			699889
polarssl	source	squeeze	0.12.1-1squeeze1		DSA-2622-1
polarssl	source	(unstable)	1.1.4-2			699887
tlslite	source	(unstable)	(unfixed)

Notes

[wheezy] - bouncycastle <no-dsa> (Minor issue)
[squeeze] - bouncycastle <no-dsa> (Minor issue)
[squeeze] - nss <no-dsa> (Minor issue)
[squeeze] - gnutls26 <no-dsa> (Too intrusive to backport)
[squeeze] - matrixssl <no-dsa> (Minor issue)
[wheezy] - matrixssl <no-dsa> (Minor issue)
matrixssl fixed this upstream in 3.4.1
[wheezy] - tlslite <no-dsa> (Minor issue)
http://www.isg.rhul.ac.uk/tls/TLStiming.pdf