Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2020-12413

Summary
Assigner-mozilla
Assigner Org ID-f16b083a-5664-49f3-a51e-8d479e5ed7fe
Published At-16 Feb, 2023 | 00:00
Updated At-19 Mar, 2025 | 15:23
Rejected At-
Credits

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:mozilla
Assigner Org ID:f16b083a-5664-49f3-a51e-8d479e5ed7fe
Published At:16 Feb, 2023 | 00:00
Updated At:19 Mar, 2025 | 15:23
Rejected At:
▼CVE Numbering Authority (CNA)

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.

Affected Products
Vendor
Mozilla CorporationMozilla
Product
Firefox
Versions
Affected
  • From unspecified before 78 (custom)
Vendor
Mozilla CorporationMozilla
Product
Firefox ESR
Versions
Affected
  • From unspecified before 68.10 (custom)
Problem Types
TypeCWE IDDescription
textN/ATiming Attack on DHE Ciphersuites
Type: text
CWE ID: N/A
Description: Timing Attack on DHE Ciphersuites
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://raccoon-attack.com/
N/A
https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413
N/A
Hyperlink: https://raccoon-attack.com/
Resource: N/A
Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413
Resource: N/A
▼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://raccoon-attack.com/
x_transferred
https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413
x_transferred
Hyperlink: https://raccoon-attack.com/
Resource:
x_transferred
Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413
Resource:
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-203CWE-203 Observable Discrepancy
Type: CWE
CWE ID: CWE-203
Description: CWE-203 Observable Discrepancy
Metrics
VersionBase scoreBase severityVector
3.15.9MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Version: 3.1
Base score: 5.9
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security@mozilla.org
Published At:16 Feb, 2023 | 22:15
Updated At:19 Mar, 2025 | 16:15

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.15.9MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Secondary3.15.9MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Type: Primary
Version: 3.1
Base score: 5.9
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Type: Secondary
Version: 3.1
Base score: 5.9
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE Matches

Mozilla Corporation
mozilla
>>firefox>>Versions before 78.0(exclusive)
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Mozilla Corporation
mozilla
>>firefox_esr>>Versions before 68.10.0(exclusive)
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-203Primarynvd@nist.gov
CWE-203Secondary134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE ID: CWE-203
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-203
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413security@mozilla.org
Issue Tracking
https://raccoon-attack.com/security@mozilla.org
Technical Description
https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
https://raccoon-attack.com/af854a3a-2127-422b-91ae-364da2661108
Technical Description
Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413
Source: security@mozilla.org
Resource:
Issue Tracking
Hyperlink: https://raccoon-attack.com/
Source: security@mozilla.org
Resource:
Technical Description
Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Issue Tracking
Hyperlink: https://raccoon-attack.com/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Technical Description

Change History

0
Information is not available yet

Similar CVEs

83Records found

CVE-2023-5981
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-5.9||MEDIUM
EPSS-0.50% / 64.77%
||
7 Day CHG-0.08%
Published-28 Nov, 2023 | 11:49
Updated-23 Nov, 2024 | 00:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Gnutls: timing side-channel in the rsa-psk authentication

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

Action-Not Available
Vendor-Red Hat, Inc.GNUFedora Project
Product-gnutlsfedoralinuxRed Hat Enterprise Linux 8.6 Extended Update SupportRHOL-5.8-RHEL-9RHODF-4.15-RHEL-9Red Hat Enterprise Linux 7Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat Enterprise Linux 9Red Hat Enterprise Linux 6Red Hat Enterprise Linux 8Red Hat Enterprise Linux 9.2 Extended Update Support
CWE ID-CWE-203
Observable Discrepancy
CVE-2023-49092
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-5.9||MEDIUM
EPSS-0.57% / 67.53%
||
7 Day CHG~0.00%
Published-28 Nov, 2023 | 20:57
Updated-27 Nov, 2024 | 16:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
RustCrypto/RSA vulnerable to a Marvin Attack via key recovery through timing sidechannels

RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is currently no fix available. As a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer.

Action-Not Available
Vendor-rustcryptoRustCrypto
Product-rsaRSA
CWE ID-CWE-385
Covert Timing Channel
CWE ID-CWE-203
Observable Discrepancy
CVE-2023-52323
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.07% / 22.94%
||
7 Day CHG~0.00%
Published-05 Jan, 2024 | 00:00
Updated-03 Jun, 2025 | 15:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

Action-Not Available
Vendor-pycryptodomen/a
Product-pycryptodomepycryptodomexn/a
CWE ID-CWE-203
Observable Discrepancy
CVE-2015-0837
Matching Score-4
Assigner-Debian GNU/Linux
ShareView Details
Matching Score-4
Assigner-Debian GNU/Linux
CVSS Score-5.9||MEDIUM
EPSS-0.55% / 66.98%
||
7 Day CHG~0.00%
Published-29 Nov, 2019 | 21:10
Updated-06 Aug, 2024 | 04:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."

Action-Not Available
Vendor-gnupgDebian GNU/LinuxGNU
Product-gnupglibgcryptdebian_linuxLibgcryptGnuPG
CWE ID-CWE-203
Observable Discrepancy
CVE-2023-46739
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-6.5||MEDIUM
EPSS-0.06% / 19.59%
||
7 Day CHG~0.00%
Published-03 Jan, 2024 | 16:15
Updated-17 Jun, 2025 | 20:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Timing attack can leak user passwords

CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component. The issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading.

Action-Not Available
Vendor-cubefsThe Linux Foundation
Product-cubefscubefs
CWE ID-CWE-203
Observable Discrepancy
CVE-2022-2891
Matching Score-4
Assigner-WPScan
ShareView Details
Matching Score-4
Assigner-WPScan
CVSS Score-5.9||MEDIUM
EPSS-0.45% / 62.61%
||
7 Day CHG~0.00%
Published-10 Oct, 2022 | 00:00
Updated-03 Aug, 2024 | 00:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WP 2FA < 2.3.0 - Time-Based Side-Channel Attack

The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.

Action-Not Available
Vendor-wpwhitesecurityUnknown
Product-wp_2faWP 2FA
CWE ID-CWE-203
Observable Discrepancy
CVE-2020-14002
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.81% / 73.26%
||
7 Day CHG~0.00%
Published-29 Jun, 2020 | 00:00
Updated-04 Aug, 2024 | 12:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).

Action-Not Available
Vendor-puttyn/aNetApp, Inc.Fedora Project
Product-oncommand_unified_manager_core_packagefedoraputtyn/a
CWE ID-CWE-203
Observable Discrepancy
CVE-2021-29445
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-5.9||MEDIUM
EPSS-0.39% / 59.49%
||
7 Day CHG~0.00%
Published-16 Apr, 2021 | 21:50
Updated-03 Aug, 2024 | 22:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime

jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`. Users should upgrade to `^3.11.4`.

Action-Not Available
Vendor-jose-node-cjs-runtime_projectpanva
Product-jose-node-cjs-runtimejose-node-esm-runtime
CWE ID-CWE-203
Observable Discrepancy
CVE-2022-27221
Matching Score-4
Assigner-Siemens
ShareView Details
Matching Score-4
Assigner-Siemens
CVSS Score-5.9||MEDIUM
EPSS-0.37% / 57.95%
||
7 Day CHG~0.00%
Published-14 Jun, 2022 | 09:21
Updated-21 Apr, 2025 | 13:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack.

Action-Not Available
Vendor-Siemens AG
Product-sinema_remote_connect_serverSINEMA Remote Connect Server
CWE ID-CWE-203
Observable Discrepancy
CVE-2021-21575
Matching Score-4
Assigner-Dell
ShareView Details
Matching Score-4
Assigner-Dell
CVSS Score-5.9||MEDIUM
EPSS-0.09% / 27.03%
||
7 Day CHG~0.00%
Published-02 Feb, 2024 | 15:53
Updated-03 Aug, 2024 | 18:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability.

Action-Not Available
Vendor-Dell Inc.
Product-bsafe_micro-edition-suiteBSAFE Micro Edition Suite
CWE ID-CWE-208
Observable Timing Discrepancy
CWE ID-CWE-203
Observable Discrepancy
CVE-2022-4304
Matching Score-4
Assigner-OpenSSL Software Foundation
ShareView Details
Matching Score-4
Assigner-OpenSSL Software Foundation
CVSS Score-5.9||MEDIUM
EPSS-0.18% / 39.87%
||
7 Day CHG~0.00%
Published-08 Feb, 2023 | 19:04
Updated-27 Aug, 2025 | 20:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Timing Oracle in RSA Decryption

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.

Action-Not Available
Vendor-stormshieldOpenSSL
Product-opensslstormshield_network_securitysslvpnendpoint_securityOpenSSL
CWE ID-CWE-203
Observable Discrepancy
CVE-2019-9494
Matching Score-4
Assigner-CERT/CC
ShareView Details
Matching Score-4
Assigner-CERT/CC
CVSS Score-5.9||MEDIUM
EPSS-1.55% / 80.68%
||
7 Day CHG~0.00%
Published-17 Apr, 2019 | 13:31
Updated-04 Aug, 2024 | 21:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacks

The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.

Action-Not Available
Vendor-w1.fiWi-Fi AllianceopenSUSEFedora ProjectFreeBSD FoundationSynology, Inc.
Product-freebsdradius_serverfedorahostapdbackports_slewpa_supplicantrouter_managerleapwpa_supplicant with SAE supporthostapd with SAE support
CWE ID-CWE-524
Use of Cache Containing Sensitive Information
CWE ID-CWE-208
Observable Timing Discrepancy
CWE ID-CWE-203
Observable Discrepancy
CVE-2023-40343
Matching Score-4
Assigner-Jenkins Project
ShareView Details
Matching Score-4
Assigner-Jenkins Project
CVSS Score-5.9||MEDIUM
EPSS-0.07% / 23.03%
||
7 Day CHG~0.00%
Published-16 Aug, 2023 | 14:32
Updated-08 Oct, 2024 | 18:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.

Action-Not Available
Vendor-Jenkins
Product-tuleap_authenticationJenkins Tuleap Authentication Plugin
CWE ID-CWE-203
Observable Discrepancy
CVE-2019-20399
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.39% / 59.37%
||
7 Day CHG~0.00%
Published-22 Jan, 2020 | 23:12
Updated-05 Aug, 2024 | 02:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.

Action-Not Available
Vendor-parityn/a
Product-libsecp256k1n/a
CWE ID-CWE-203
Observable Discrepancy
CVE-2019-16782
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-6.3||MEDIUM
EPSS-1.63% / 81.16%
||
7 Day CHG~0.00%
Published-18 Dec, 2019 | 19:05
Updated-13 Feb, 2025 | 15:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Possible Information Leak / Session Hijack Vulnerability in Rack

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

Action-Not Available
Vendor-rackrackFedora ProjectopenSUSE
Product-rackfedoraleaprack
CWE ID-CWE-203
Observable Discrepancy
CWE ID-CWE-208
Observable Timing Discrepancy
CVE-2019-16863
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.27% / 49.69%
||
7 Day CHG~0.00%
Published-14 Nov, 2019 | 02:07
Updated-05 Aug, 2024 | 01:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.

Action-Not Available
Vendor-stn/a
Product-st33tphf2ei2c_firmwarest33tphf2espi_firmwarest33tphf20spi_firmwarest33tphf20spist33tphf2ei2cst33tphf20i2cst33tphf20i2c_firmwarest33tphf2espin/a
CWE ID-CWE-327
Use of a Broken or Risky Cryptographic Algorithm
CWE ID-CWE-203
Observable Discrepancy
CVE-2019-1559
Matching Score-4
Assigner-OpenSSL Software Foundation
ShareView Details
Matching Score-4
Assigner-OpenSSL Software Foundation
CVSS Score-5.9||MEDIUM
EPSS-7.08% / 91.14%
||
7 Day CHG+0.86%
Published-27 Feb, 2019 | 23:00
Updated-17 Sep, 2024 | 04:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
0-byte record padding oracle

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

Action-Not Available
Vendor-Canonical Ltd.Palo Alto Networks, Inc.F5, Inc.Fedora ProjectOracle CorporationTenable, Inc.Red Hat, Inc.McAfee, LLCDebian GNU/LinuxopenSUSENode.js (OpenJS Foundation)OpenSSLNetApp, Inc.
Product-communications_diameter_signaling_routercommunications_unified_session_managerubuntu_linuxbig-ip_webacceleratora320_firmwarebig-ip_application_acceleration_managerpeoplesoft_enterprise_peopletoolsopensslbig-ip_policy_enforcement_managercloud_backupfas2720threat_intelligence_exchange_servervirtualization_hostbusiness_intelligenceoncommand_unified_manager_core_packagebig-ip_local_traffic_managersantricity_smi-s_providercommunications_performance_intelligence_centeragentsnapcentersteelstore_cloud_integrated_storageontap_select_deploysmi-s_providerfas2750_firmwareontap_select_deploy_administration_utilityhci_management_nodeenterprise_linux_workstationfedoraa220traffix_signaling_delivery_controllerenterprise_linux_desktopapi_gatewaycommunications_session_routerweb_gatewayleapendeca_serverservice_processorenterprise_linuxa320big-ip_domain_name_systemmysql_workbenchsolidfirebig-ip_edge_gatewaydebian_linuxbig-iq_centralized_managementmysql_enterprise_monitorjboss_enterprise_web_serversecure_global_desktopstorage_automation_storea220_firmwaresnapprotectoncommand_unified_managermysqlenterprise_manager_base_platformenterprise_linux_serverpan-osbig-ip_fraud_protection_servicefas2720_firmwarec190services_tools_bundlestoragegridhci_compute_nodebig-ip_application_security_managernode.jssnapdrivefas2750big-ip_access_policy_managercn1610_firmwarecommunications_session_border_controllerenterprise_manager_ops_centernessusoncommand_insightjd_edwards_world_securityaltavaulta800virtualizationhyper_converged_infrastructurecn1610active_iq_unified_managerbig-ip_global_traffic_managerbig-ip_analyticsoncommand_workflow_automationelement_softwarea800_firmwarebig-ip_link_controllerdata_exchange_layerclustered_data_ontap_antivirus_connectorc190_firmwarebig-ip_advanced_firewall_managerjd_edwards_enterpriseone_toolsOpenSSL
CWE ID-CWE-203
Observable Discrepancy
CVE-2023-32691
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-5.9||MEDIUM
EPSS-0.21% / 44.07%
||
7 Day CHG~0.00%
Published-30 May, 2023 | 03:06
Updated-10 Jan, 2025 | 20:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
ginuerzh/gost vulnerable to Timing Attack

gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparison function. Untrusted input, sourced from a HTTP header, is compared directly with a secret. Since this comparison is not secure, an attacker can mount a side-channel timing attack to guess the password. As a workaround, this can be easily fixed using a constant time comparing function such as `crypto/subtle`'s `ConstantTimeCompare`.

Action-Not Available
Vendor-go_simple_tunnel_projectginuerzh
Product-go_simple_tunnelgost
CWE ID-CWE-203
Observable Discrepancy
CVE-2019-13629
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.27% / 50.36%
||
7 Day CHG~0.00%
Published-03 Oct, 2019 | 13:23
Updated-04 Aug, 2024 | 23:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because crypto/pubkey/ecc_math.c scalar multiplication leaks the bit length of the scalar.

Action-Not Available
Vendor-matrixssln/a
Product-matrixssln/a
CWE ID-CWE-327
Use of a Broken or Risky Cryptographic Algorithm
CWE ID-CWE-203
Observable Discrepancy
CVE-2019-13377
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-1.11% / 77.24%
||
7 Day CHG~0.00%
Published-15 Aug, 2019 | 16:05
Updated-04 Aug, 2024 | 23:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery.

Action-Not Available
Vendor-w1.fin/aCanonical Ltd.Fedora ProjectDebian GNU/Linux
Product-ubuntu_linuxhostapddebian_linuxfedoran/a
CWE ID-CWE-203
Observable Discrepancy
CVE-2019-13420
Matching Score-4
Assigner-floragunn GmbH
ShareView Details
Matching Score-4
Assigner-floragunn GmbH
CVSS Score-5.9||MEDIUM
EPSS-0.28% / 51.03%
||
7 Day CHG~0.00%
Published-13 Aug, 2019 | 14:25
Updated-04 Aug, 2024 | 23:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.

Action-Not Available
Vendor-search-guardfloragunn
Product-search_guardSearch Guard
CWE ID-CWE-208
Observable Timing Discrepancy
CWE ID-CWE-203
Observable Discrepancy
CVE-2024-7010
Matching Score-4
Assigner-Protect AI (formerly huntr.dev)
ShareView Details
Matching Score-4
Assigner-Protect AI (formerly huntr.dev)
CVSS Score-7.5||HIGH
EPSS-0.16% / 37.07%
||
7 Day CHG+0.02%
Published-29 Oct, 2024 | 12:48
Updated-14 Nov, 2024 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Timing Attack in mudler/localai

mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid login credentials based on the server's response time, potentially leading to unauthorized access.

Action-Not Available
Vendor-mudlermudlermudler
Product-localaimudler/localailocalai
CWE ID-CWE-203
Observable Discrepancy
CVE-2019-11578
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.48% / 64.13%
||
7 Day CHG~0.00%
Published-28 Apr, 2019 | 15:22
Updated-04 Aug, 2024 | 22:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.

Action-Not Available
Vendor-dhcpcd_projectn/a
Product-dhcpcdn/a
CWE ID-CWE-203
Observable Discrepancy
CVE-2021-4294
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-2.6||LOW
EPSS-0.12% / 32.28%
||
7 Day CHG~0.00%
Published-28 Dec, 2022 | 16:51
Updated-17 May, 2024 | 02:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
OpenShift OSIN CheckClientSecret timing discrepancy

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

Action-Not Available
Vendor-OpenShiftRed Hat, Inc.
Product-openshift_container_platformopenshift_osinOSIN
CWE ID-CWE-208
Observable Timing Discrepancy
CWE ID-CWE-203
Observable Discrepancy
CVE-2017-18268
Matching Score-4
Assigner-Symantec - A Division of Broadcom
ShareView Details
Matching Score-4
Assigner-Symantec - A Division of Broadcom
CVSS Score-5.9||MEDIUM
EPSS-0.38% / 58.66%
||
7 Day CHG~0.00%
Published-17 May, 2018 | 13:00
Updated-16 Sep, 2024 | 17:47
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Symantec IntelligenceCenter 3.3 is vulnerable to the Return of the Bleichenbacher Oracle Threat (ROBOT) attack. A remote attacker, who has captured a pre-recorded SSL session inspected by SSLV, can establish large numbers of crafted SSL connections to the target and obtain the session keys required to decrypt the pre-recorded SSL session.

Action-Not Available
Vendor-Broadcom Inc.Symantec Corporation
Product-symantec_intelligencecenterIntelligenceCenter
CWE ID-CWE-203
Observable Discrepancy
CVE-2021-29443
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-5.9||MEDIUM
EPSS-0.32% / 54.08%
||
7 Day CHG~0.00%
Published-16 Apr, 2021 | 17:35
Updated-03 Aug, 2024 | 22:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Padding Oracle Attack due to Observable Timing Discrepancy in jose

jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. A possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). All major release versions have had a patch released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `^1.28.1 || ^2.0.5 || >=3.11.4`. Users should upgrade their v1.x dependency to ^1.28.1, their v2.x dependency to ^2.0.5, and their v3.x dependency to ^3.11.4. Thanks to Jason from Microsoft Vulnerability Research (MSVR) for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.

Action-Not Available
Vendor-jose_projectpanva
Product-josejose
CWE ID-CWE-203
Observable Discrepancy
CVE-2021-29444
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-5.9||MEDIUM
EPSS-0.39% / 59.49%
||
7 Day CHG~0.00%
Published-16 Apr, 2021 | 21:45
Updated-03 Aug, 2024 | 22:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime

jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`. Users should upgrade to `^3.11.4`.

Action-Not Available
Vendor-jose-node-cjs-runtime_projectpanva
Product-jose-node-cjs-runtimejose
CWE ID-CWE-203
Observable Discrepancy
CVE-2024-50383
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.16% / 37.17%
||
7 Day CHG~0.00%
Published-23 Oct, 2024 | 00:00
Updated-10 Jul, 2025 | 19:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be affected.)

Action-Not Available
Vendor-botan_projectn/abotan_project
Product-botann/abotan
CWE ID-CWE-203
Observable Discrepancy
CVE-2024-50382
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.16% / 37.17%
||
7 Day CHG~0.00%
Published-23 Oct, 2024 | 00:00
Updated-10 Jul, 2025 | 19:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V.

Action-Not Available
Vendor-botan_projectn/abotan_project
Product-botann/abotan
CWE ID-CWE-203
Observable Discrepancy
CVE-2021-33880
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.19% / 41.33%
||
7 Day CHG~0.00%
Published-06 Jun, 2021 | 14:05
Updated-04 Aug, 2024 | 00:05
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Action-Not Available
Vendor-websockets_projectn/aOracle Corporation
Product-communications_cloud_native_core_service_communication_proxycommunications_cloud_native_core_security_edge_protection_proxycommunications_cloud_native_core_unified_data_repositorywebsocketscommunications_cloud_native_core_policyn/a
CWE ID-CWE-203
Observable Discrepancy
CVE-2021-29446
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-5.9||MEDIUM
EPSS-0.39% / 59.49%
||
7 Day CHG~0.00%
Published-16 Apr, 2021 | 22:00
Updated-03 Aug, 2024 | 22:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`. Users should upgrade to `^3.11.4`.

Action-Not Available
Vendor-jose-node-cjs-runtime_projectpanva
Product-jose-node-cjs-runtimejose-node-cjs-runtime
CWE ID-CWE-203
Observable Discrepancy
CVE-2020-5929
Matching Score-4
Assigner-F5, Inc.
ShareView Details
Matching Score-4
Assigner-F5, Inc.
CVSS Score-5.9||MEDIUM
EPSS-0.67% / 70.37%
||
7 Day CHG~0.00%
Published-25 Sep, 2020 | 13:22
Updated-04 Aug, 2024 | 08:47
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle. Similar error messages when PMS starts with 0 byte coupled with very precise timing measurement observation may also expose this vulnerability.

Action-Not Available
Vendor-n/aF5, Inc.
Product-big-ip_application_acceleration_managerbig-ip_advanced_web_application_firewallbig-ip_link_controllerbig-ip_policy_enforcement_managerbig-ip_fraud_protection_servicebig-ip_global_traffic_managerbig-ip_analyticsbig-ip_access_policy_managerbig-ip_domain_name_systembig-ip_local_traffic_managerbig-ip_advanced_firewall_managerssl_orchestratorbig-ip_application_security_managerbig-ip_ddos_hybrid_defenderBIG-IP
CWE ID-CWE-203
Observable Discrepancy
CVE-2024-2408
Matching Score-4
Assigner-PHP Group
ShareView Details
Matching Score-4
Assigner-PHP Group
CVSS Score-5.9||MEDIUM
EPSS-0.13% / 33.24%
||
7 Day CHG~0.00%
Published-09 Jun, 2024 | 19:55
Updated-21 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
PHP is vulnerable to the Marvin Attack

The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability.

Action-Not Available
Vendor-phpThe PHP GroupFedora Project
Product-phpfedoraPHPphpfedora
CWE ID-CWE-203
Observable Discrepancy
  • Previous
  • 1
  • 2
  • Next
Details not found