{"id":"CVE-2013-1619","aliases":["DEBIAN-CVE-2013-1619","EUVD-2013-1654","GHSA-qmwj-552p-59h4","RHSA-2013:0588","RHSA-2013:0636","UBUNTU-CVE-2013-1619"],"status":"published","title":"The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does...","description":"The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0644,"percentile":0.93768,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2013-02-08T00:00:00Z","modified":"2026-09-01T20:03:14Z","fixes":[{"ecosystem":"Debian:12","package":"gnutls28","fixed_in":["3.0.22-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnutls28","fixed_in":["3.0.22-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnutls28","fixed_in":["3.0.22-3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls","fixed_in":["0:1.4.1-10.el5_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-debuginfo","fixed_in":["0:1.4.1-10.el5_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-devel","fixed_in":["0:1.4.1-10.el5_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-utils","fixed_in":["0:1.4.1-10.el5_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-debuginfo","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-utils","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-devel","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-guile","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-debuginfo","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-utils","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-devel","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-guile","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-debuginfo","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-devel","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-utils","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-guile","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-debuginfo","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-devel","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-utils","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-guile","fixed_in":["0:2.8.5-10.el6_4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.22-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.22-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.22-3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-10.el5_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-10.el5_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-10.el5_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-10.el5_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-10.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"rhev-hypervisor6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4-20130306.2.el6_4"}]}],"bundled":5}],"products":[{"vendor":"gnu","product":"gnutls"}],"references":[{"url":"http://secunia.com/advisories/57260","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://gitorious.org/gnutls/gnutls/commit/328ee22c1b3951e060c7124c7cb1cee592c59bc0","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://www.gnutls.org/security.html#GNUTLS-SA-2013-1","tags":["x_refsource_CONFIRM","x_transferred","web","article"]},{"url":"http://www.isg.rhul.ac.uk/tls/TLStiming.pdf","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"http://secunia.com/advisories/57274","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://openwall.com/lists/oss-security/2013/02/05/24","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://nmav.gnutls.org/2013/02/time-is-money-for-cbc-ciphersuites.html","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"http://www.ubuntu.com/usn/USN-1752-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-05/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0588.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://gitorious.org/gnutls/gnutls/commit/b8391806cd79095fe566f2401d8c7ad85a64b198","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1619","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qmwj-552p-59h4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-1619","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0588","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=908238","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0588.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1619","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1619","tags":["advisory","report"]},{"url":"http://www.isg.rhul.ac.uk/tls/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0636","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=857051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=907589","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=908052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=913267","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0636.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-4929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4929","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6075","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6075","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6075","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0166","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0166","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0166","tags":["advisory"]},{"url":"http://www.openssl.org/news/secadv_20130205.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0169","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0169","tags":["advisory"]},{"url":"https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2013-1619","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-1752-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-1619","description":"The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.","status":"published","published":"2013-02-08T19:00:00Z","modified":"2024-08-06T15:04:49.607Z","updated_at":"2026-11-02T14:34:58.882751Z"}],"euvd":[{"id":"EUVD-2013-1654","description":"The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.","status":"published","published":"2013-02-08T19:00:00Z","modified":"2024-08-06T15:04:49Z","updated_at":"2026-11-03T01:56:41.572158Z"}],"ghsa":[{"id":"GHSA-qmwj-552p-59h4","title":"The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does...","description":"The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.","status":"published","published":"2022-05-17T04:48:37Z","modified":"2023-01-28T05:02:42Z","updated_at":"2026-11-02T14:43:49.735086Z"}],"nvd":[{"id":"CVE-2013-1619","description":"The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.","status":"published","published":"2013-02-08T19:55:01.157Z","modified":"2026-06-16T23:51:47.377Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:21.222658Z"}],"osv":[{"id":"CVE-2013-1619","description":"The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.","status":"published","published":"2013-02-08T19:55:01Z","modified":"2026-04-10T03:42:42.382843Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-1619","description":"The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.","status":"published","published":"2013-02-08T19:55:01.157Z","modified":"2026-09-01T20:03:14.873453541Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"RHSA-2013:0588","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-13T07:36:12Z","modified":"2026-06-28T10:07:43Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:0636","title":"Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update","status":"published","published":"2024-09-13T08:01:48Z","modified":"2026-08-05T10:02:07Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"UBUNTU-CVE-2013-1619","description":"The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.","status":"withdrawn","published":"2013-02-08T00:00:00Z","modified":"2026-02-04T03:41:15.110161Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}