CVE-2003-0131
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote...
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."
Exploit likelihood
What each source reports
NVD Score used
7.5
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."
- Record
CVE-2003-0131- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."
- Record
CVE-2003-0131- Updated
- 2026-11-02
EUVDEUVD-2003-0127 No score
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."
- Record
EUVD-2003-0127- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6rjg-j93g-96pp No score
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote...
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."
- Record
GHSA-6rjg-j93g-96pp- Updated
- 2026-11-02
OSV No score
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."
- Record
CVE-2003-0131- Updated
- 2026-11-02
OSVDEBIAN-CVE-2003-0131 No score
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."
- Record
DEBIAN-CVE-2003-0131- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0131 is a high vulnerability (CVSS 7.5) in Openssl, published March 21, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.94%, the 94th percentile. Fixed in openssl 0.9.7b-1.
References
debian.org/security/2003/dsa-288
redhat.com/support/errata/RHSA-2003-101.html
redhat.com/support/errata/RHSA-2003-102.html
marc.info?l=bugtraq&m=104878215721135&w=2
eprint.iacr.org/2003/052
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A461
Show 17 moreShow less
gentoo.org/security/en/glsa/glsa-200303-20.xml
lists.opensuse.org/opensuse-security-announce/2003-04/msg00005.html
securityfocus.com/bid/7148
lists.apple.com/mhonarc/security-announce/msg00028.html
openpkg.org/security/OpenPKG-SA-2003.026-openssl.html
linuxsecurity.com/advisories/immunix_advisory-3066.html
securityfocus.com/archive/1/316577/30/25310/threaded
openssl.org/news/secadv_20030319.txt
mandriva.com/security/advisories?name=MDKSA-2003:035
marc.info?l=bugtraq&m=104852637112330&w=2
exchange.xforce.ibmcloud.com/vulnerabilities/11586
marc.info?l=bugtraq&m=104811162730834&w=2
kb.cert.org/vuls/id/888801
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000625
nvd.nist.gov/vuln/detail/CVE-2003-0131
github.com/advisories/GHSA-6rjg-j93g-96pp
security-tracker.debian.org/tracker/CVE-2003-0131