CVE-2013-6450
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f...
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.
Exploit likelihood
What each source reports
NVD Score used
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.
- Record
CVE-2013-6450- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.
- Record
CVE-2013-6450- Updated
- 2026-11-02
EUVDEUVD-2013-6257 No score
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.
- Record
EUVD-2013-6257- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3qp2-qh33-29hx No score
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f...
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.
- Record
GHSA-3qp2-qh33-29hx- Updated
- 2026-11-02
OSVBELL-CVE-2013-6450
CVE-2013-6450 does not affect BellSoft software
- Record
BELL-CVE-2013-6450- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Updated
- 2026-11-02
OSV No score
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.
- Record
CVE-2013-6450- Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2013-6450 No score
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.
- Record
DEBIAN-CVE-2013-6450- Updated
- 2026-11-02
OSVMGASA-2014-0012 No score
Updated openssl package fixes security vulnerabilities
Updated openssl packages fix security vulnerabilities:
The DTLS retransmission implementation in OpenSSL through 1.0.1e does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context by interfering with packet delivery (CVE-2013-6450).
A carefully crafted invalid TLS handshake could crash OpenSSL with a NULL pointer exception. A malicious server could use this flaw to crash a connecting client (CVE-2013-4353).
- Record
MGASA-2014-0012- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score
libopenssl-devel-1.0.2j-2.2 on GA media
These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10271-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score
libopenssl1_0_0-steam-1.0.2h-4.1 on GA media
These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10529-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score
libopenssl-1_1-devel-1.1.1l-1.2 on GA media
These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11127-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 |
before 1.0.1e-5 | 1.0.1e-5 |
opensslDebian:13 |
before 1.0.1e-5 | 1.0.1e-5 |
opensslDebian:14 |
before 1.0.1e-5 | 1.0.1e-5 |
opensslDebian:7 From an advisory covering 2 CVEs |
before 1.0.1e-2+deb7u1, plus listed versions 1.0.1e-2 |
1.0.1e-2+deb7u1 |
opensslMageia:3 From an advisory covering 2 CVEs |
before 1.0.1e-1.3.mga3 | 1.0.1e-1.3.mga3 |
opensslRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-develRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-perlRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-staticRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensslRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-develRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-perlRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-staticRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
opensslRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-develRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-perlRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-staticRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
opensslRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-develRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-perlRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-staticRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:1.0.1e-16.el6_5.4 | 0:1.0.1e-16.el6_5.4 |
openssl-1_1openSUSE:Tumbleweed From an advisory covering 136 CVEs |
before 1.1.1l-1.2 | 1.1.1l-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6450 is a medium vulnerability (CVSS 5.8) in Openssl, published January 1, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 15.3%, the 96th percentile. Fixed in openssl 1.0.1e-5.
References
lists.opensuse.org/opensuse-updates/2014-01/msg00032.html
vmware.com/security/advisories/VMSA-2014-0012.html
securitytracker.com/id/1031594
www-01.ibm.com/support/docview.wss?uid=isg400001843
security.gentoo.org/glsa/glsa-201412-39.xml
Show 194 moreShow less
debian.org/security/2014/dsa-2833
puppet.com/security/cve/cve-2013-6450
git.openssl.org/gitweb?p=openssl.git%3Ba=commit%3Bh=34628967f1e65dc8f34e000f0f5518e21afbfc7b
securityfocus.com/archive/1/534161/100/0/threaded
lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
oracle.com/technetwork/topics/security/cpujan2015-1972971.html
ubuntu.com/usn/USN-2079-1
security-tracker.debian.org/tracker/CVE-2013-6450
rhn.redhat.com/errata/RHSA-2014-0015.html
seclists.org/fulldisclosure/2014/Dec/23
openssl.org/news/vulnerabilities.html
nvd.nist.gov/vuln/detail/CVE-2013-6450
github.com/advisories/GHSA-3qp2-qh33-29hx
docs.bell-sw.com/security/cves/CVE-2013-6450
advisories.mageia.org/MGASA-2014-0012.html
bugs.mageia.org/show_bug.cgi?id=12183
access.redhat.com/errata/RHSA-2014:0015
bugzilla.redhat.com/show_bug.cgi?id=1045363
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0015.json
cve.org/CVERecord?id=CVE-2013-4353
suse.com/support/update/announcement/-2022-445/suse-fu-20220445-1
bugzilla.suse.com/1000080
Left out here: 522 references. The JSON record has them.