Description
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
Remediation
References
Related Vulnerabilities
MongoDb CVE-2024-7553 Vulnerability (CVE-2024-7553)
PostgreSQL Out-of-bounds Write Vulnerability (CVE-2019-10164)
WordPress Plugin Side Cart Woocommerce (Ajax) Cross-Site Request Forgery (2.0)
Oracle JRE CVE-2018-2641 Vulnerability (CVE-2018-2641)
Drupal Core 7.x Multiple Security Bypass Vulnerabilities (7.0 - 7.25)