The TLS implementation in Mozilla Network Security Services (NSS) does not properly…
Priority LOW 26CWE-203Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-203.
Summary
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Why it matters now
EPSS 0.03723 89th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:* | before 3.14.3 | Vulnerable | Mozilla |
| cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* | 10.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* | 11.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* | 12.10 | Vulnerable | Canonical |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:11.1:*:*:*:*:*:*:* | 11.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1:*:*:*:*:*:*:* | 12.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2:*:*:*:*:*:*:* | 12.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:glassfish_communications_server:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:glassfish_server:2.1.1:*:*:*:*:*:*:* | 2.1.1 | Vulnerable | Oracle |
- cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:* Versions before 3.14.3 Vulnerable ·Mozilla
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* Versions 10.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* Versions 11.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* Versions 12.10 Vulnerable ·Canonical
- cpe:2.3:a:oracle:enterprise_manager_ops_center:11.1:*:*:*:*:*:*:* Versions 11.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:glassfish_communications_server:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:glassfish_server:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Oracle
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:iplanet_web_proxy_server:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:iplanet_web_server:6.1:*:*:*:*:*:*:* | 6.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:iplanet_web_server:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:opensso:3.0-03:*:*:*:*:*:*:* | 3.0-03 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:traffic_director:11.1.1.6.0:*:*:*:*:*:*:* | 11.1.1.6.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:traffic_director:11.1.1.7.0:*:*:*:*:*:*:* | 11.1.1.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:* | 3.2 | Vulnerable | Oracle |
| cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:* | 5.9 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:* | 5.9 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
- cpe:2.3:a:oracle:iplanet_web_proxy_server:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:iplanet_web_server:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:iplanet_web_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:opensso:3.0-03:*:*:*:*:*:*:* Versions 3.0-03 Vulnerable ·Oracle
- cpe:2.3:a:oracle:traffic_director:11.1.1.6.0:*:*:*:*:*:*:* Versions 11.1.1.6.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:traffic_director:11.1.1.7.0:*:*:*:*:*:*:* Versions 11.1.1.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:* Versions 3.2 Vulnerable ·Oracle
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:* Versions 5.9 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:* Versions 5.9 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
Remediation
Red Hat 3 advisories
- RHSA-2013:1181 Released 2013-08-27 · Red Hat rating Moderaterhev-hypervisor6 security and bug fix update
- RHEV Hypervisor for RHEL-6 rhev-hypervisor6-6.4-20130815.0.el6_4
- RHSA-2013:1144 Released 2013-08-07 · Red Hat rating Moderatenss, nss-util, nss-softokn, and nspr security update
- Red Hat Enterprise Linux Desktop (v. 6) nspr-4.9.5-2.el6_4, nss-3.14.3-4.el6_4, nss-softokn-3.14.3-3.el6_4 +4
- Red Hat Enterprise Linux Desktop Optional (v. 6) nspr-4.9.5-2.el6_4, nspr-devel-4.9.5-2.el6_4, nss-3.14.3-4.el6_4 +7
- Red Hat Enterprise Linux HPC Node (v. 6) nspr-4.9.5-2.el6_4, nss-3.14.3-4.el6_4, nss-softokn-3.14.3-3.el6_4 +4
- Red Hat Enterprise Linux HPC Node Optional (v. 6) nspr-4.9.5-2.el6_4, nspr-devel-4.9.5-2.el6_4, nss-3.14.3-4.el6_4 +7
- Red Hat Enterprise Linux Server (v. 6) nspr-4.9.5-2.el6_4, nspr-4.9.5-2.el6_4.ppc, nspr-devel-4.9.5-2.el6_4 +19
- Red Hat Enterprise Linux Server Optional (v. 6) nss-3.14.3-4.el6_4, nss-pkcs11-devel-3.14.3-4.el6_4, nss-pkcs11-devel-3.14.3-4.el6_4.ppc
- Red Hat Enterprise Linux Workstation (v. 6) nspr-4.9.5-2.el6_4, nspr-devel-4.9.5-2.el6_4, nss-3.14.3-4.el6_4 +9
- Red Hat Enterprise Linux Workstation Optional (v. 6) nss-3.14.3-4.el6_4, nss-pkcs11-devel-3.14.3-4.el6_4
- RHSA-2013:1135 Released 2013-08-05 · Red Hat rating Moderatenss and nspr security, bug fix, and enhancement update
- Red Hat Enterprise Linux (v. 5 server) nspr-4.9.5-1.el5_9, nspr-4.9.5-1.el5_9.i386, nspr-4.9.5-1.el5_9.ia64 +21
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHEV Hypervisor for RHEL-6 | Fixed | RHSA-2013:1181 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2013:1135 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2013:1144 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2013:1144 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2013:1144 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2013:1144 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2013:1144 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2013:1144 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2013:1144 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2013:1144 |
Timeline
- 2026-10-02 Threatist record created from CVE-2013-1620
- 2026-10-03 Alias added: GHSA-4pp6-m86c-j4gj
References
Advisory 16
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://www.isg.rhul.ac.uk/tls/TLStiming.pdf
- openSUSE-SU-2013:0630
- [oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- USN-1763-1
- GLSA-201406-19
- RHSA-2013:1135
- http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- RHSA-2013:1144
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
- openSUSE-SU-2013:0631
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
Sources
- CVE-2013-1620 · CVE Program
- CVE-2013-1620 · NVD
- FIRST EPSS
- GHSA-4pp6-m86c-j4gj · GitHub Advisory Database · CC BY 4.0
- CVE-2013-1620 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences