CVE-2013-1624

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

Metrics

CVSS 2.0 4.0/10AV:N/AC:H/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-310

Affected software

No affected versions have been published.

Timeline

Published
Feb 8, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-16277.8Absolute path traversal vulnerability in NTWebServer.exe in Indusoft Studio 7.0 and earlier and Advantech Studio 7.0 and earlier allows remoCVE-2013-16296.8pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allCVE-2013-16306.8pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, whicCVE-2013-16315.3Verax NMS prior to 2.1.0 leaks connection details when any user executes a Repair Table actionCVE-2013-16336.8easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on packCVE-2013-16347.5A denial of service vulnerability exists in some motherboard implementations of Intel e1000e/82574L network controller devices through 2013-CVE-2013-16357.5ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive anCVE-2013-16364.3Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link LiteCVE-2013-16379.3Opera before 12.13 allows remote attackers to execute arbitrary code via vectors involving DOM events.CVE-2013-16389.3Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document.CVE-2013-16396.8Opera before 12.13 does not send CORS preflight requests in all required cases, which allows remote attackers to bypass a CSRF protection meCVE-2013-16409.0The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1