The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte…
Priority HIGH 68CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-327.
Summary
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.84424 99th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_application_session_controller:*:*:*:*:*:*:*:* | 3.0.0 – 3.9.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:* | 11.1.1.7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:11.1.1.9.0:*:*:*:*:*:*:* | 11.1.1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:12.1.3.0.0:*:*:*:*:*:*:* | 12.1.3.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:12.2.1.1.0:*:*:*:*:*:*:* | 12.2.1.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:* | 12.2.1.2.0 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:* | 3.0.0 – 3.2.11; 4.0.0 – 4.0.4 | Vulnerable | Oracle |
| cpe:2.3:o:fujitsu:sparc_enterprise_m3000_firmware:*:*:*:*:*:*:*:* | xcp to before xcp_1121 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:sparc_enterprise_m3000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:sparc_enterprise_m4000_firmware:*:*:*:*:*:*:*:* | xcp to before xcp_1121 | Vulnerable | Fujitsu |
- cpe:2.3:a:oracle:communications_application_session_controller:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.9.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:* Versions 11.1.1.7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:12.2.1.1.0:*:*:*:*:*:*:* Versions 12.2.1.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:* Versions 12.2.1.2.0 Vulnerable ·Oracle
- cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.2.11; 4.0.0 – 4.0.4 Vulnerable ·Oracle
- cpe:2.3:o:fujitsu:sparc_enterprise_m3000_firmware:*:*:*:*:*:*:*:* Versions xcp to before xcp_1121 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:sparc_enterprise_m3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:sparc_enterprise_m4000_firmware:*:*:*:*:*:*:*:* Versions xcp to before xcp_1121 Vulnerable ·Fujitsu
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:fujitsu:sparc_enterprise_m4000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:sparc_enterprise_m5000_firmware:*:*:*:*:*:*:*:* | xcp to before xcp_1121 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:sparc_enterprise_m5000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:sparc_enterprise_m8000_firmware:*:*:*:*:*:*:*:* | xcp to before xcp_1121 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:sparc_enterprise_m8000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:sparc_enterprise_m9000_firmware:*:*:*:*:*:*:*:* | xcp to before xcp_1121 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:sparc_enterprise_m9000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:* | xcp to before xcp2280 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:* | xcp to before xcp2280 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:* | xcp to before xcp2280 | Vulnerable | Fujitsu |
| cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fujitsu |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* | 12.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:* | 13.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:* | 13.10 | Vulnerable | Canonical |
| cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | before 17.0.11; before 25.0.1; 24.1.0 to before 24.1.1 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* | before 2.22.1 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* | before 24.1.1 | Vulnerable | Mozilla |
| cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:* | before 17.0.11 | Vulnerable | Mozilla |
- cpe:2.3:h:fujitsu:sparc_enterprise_m4000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:sparc_enterprise_m5000_firmware:*:*:*:*:*:*:*:* Versions xcp to before xcp_1121 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:sparc_enterprise_m5000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:sparc_enterprise_m8000_firmware:*:*:*:*:*:*:*:* Versions xcp to before xcp_1121 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:sparc_enterprise_m8000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:sparc_enterprise_m9000_firmware:*:*:*:*:*:*:*:* Versions xcp to before xcp_1121 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:sparc_enterprise_m9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:* Versions xcp to before xcp2280 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:* Versions xcp to before xcp2280 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:* Versions xcp to before xcp2280 Vulnerable ·Fujitsu
- cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fujitsu
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* Versions 12.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:* Versions 13.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:* Versions 13.10 Vulnerable ·Canonical
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions before 17.0.11; before 25.0.1; 24.1.0 to before 24.1.1 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* Versions before 2.22.1 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions before 24.1.1 Vulnerable ·Mozilla
- cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:* Versions before 17.0.11 Vulnerable ·Mozilla
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2013-2566
- 2026-10-03 Alias added: GHSA-f67x-vqh9-8p43
References
Advisory 20
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://cr.yp.to/talks/2013.03.12/slides.pdf
- HPSBGN03324
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- GLSA-201504-01
- GLSA-201406-19
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- USN-2031-1
- USN-2032-1
- http://my.opera.com/securitygroup/blog/2013/03/20/on-the-precariousness-of-rc4
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.opera.com/security/advisory/1046
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888
- http://www.mozilla.org/security/announce/2013/mfsa2013-103.html
- http://www.isg.rhul.ac.uk/tls/
- http://www.opera.com/docs/changelogs/unified/1215/
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935
Sources
- CVE-2013-2566 · CVE Program
- CVE-2013-2566 · NVD
- FIRST EPSS
- GHSA-f67x-vqh9-8p43 · GitHub Advisory Database · CC BY 4.0
- CVE-2013-2566 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences