CVE-2013-1623

NameCVE-2013-1623
DescriptionThe TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-2780-1
Debian Bugs699886

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mysql-5.5 (PTS)jessie, jessie (lts)5.5.62-0+deb8u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cyasslsource(unstable)(not affected)
mysql-5.1sourcesqueeze5.1.72-2DSA-2780-1
mysql-5.1source(unstable)(unfixed)
mysql-5.5source(unstable)5.5.30+dfsg-1.1699886

Notes

- cyassl <not-affected> (Fixed before initial upload to archive)
cyassl: fixed upstream in 2.5.0
Search for package or bug name: Reporting problems