The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
12 May 2025, 17:37
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.02:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.42:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.23:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.05:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.43:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.11:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.32:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.41:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.14:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.20:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.25:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.18:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.29:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.46:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.28:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.09:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.44:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.04:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.15:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.35:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.40:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.27:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.08:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.17:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.31:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.45:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.13:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.21:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.22:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.38:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.30:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.16:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.12:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.03:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.01:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.39:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.10:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.37:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.26:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.07:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.33:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.47:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.36:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.06:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.24:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.19:*:*:*:*:*:*:* |
cpe:2.3:a:bouncycastle:bc-java:1.03:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.04:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.21:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.11:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.39:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.46:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.17:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.37:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.02:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.32:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.28:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.43:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.01:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.18:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.19:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.07:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.10:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.06:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.16:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.42:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.45:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.24:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.14:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.29:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.30:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.20:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.33:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.38:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.23:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.36:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.44:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.15:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.41:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.12:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.05:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.22:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.25:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.35:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.08:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.26:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.31:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.34:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.27:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.47:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.40:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.09:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:1.13:*:*:*:*:*:*:* |
| First Time |
Bouncycastle bc-java
|
21 Nov 2024, 01:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://openwall.com/lists/oss-security/2013/02/05/24 - | |
| References | () http://rhn.redhat.com/errata/RHSA-2014-0371.html - | |
| References | () http://rhn.redhat.com/errata/RHSA-2014-0372.html - | |
| References | () http://secunia.com/advisories/57716 - | |
| References | () http://secunia.com/advisories/57719 - | |
| References | () http://www.isg.rhul.ac.uk/tls/TLStiming.pdf - |
Information
Published : 2013-02-08 19:55
Updated : 2025-05-12 17:37
NVD link : CVE-2013-1624
Mitre link : CVE-2013-1624
CVE.ORG link : CVE-2013-1624
JSON object : View
Products Affected
bouncycastle
- legion-of-the-bouncy-castle-c\#-cryptography-api
- bc-java
CWE
CWE-310
Cryptographic Issues