Read the docs
TI-2013-03611 Aliases CVE-2013-4134GHSA-rj2q-26jf-jvvq

OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption…

Priority LOW 21CWE-310Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption (DES) for Kerberos keys, which makes it easier for remote attackers to obtain the service key.

Why it matters now

EPSS 0.00761 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 81

CPEVersionsRoleVendor
cpe:2.3:a:openafs:openafs:*:*:*:*:*:*:*:*up to 1.4.14VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0:*:*:*:*:*:*:*1.0VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.0.4a:*:*:*:*:*:*:*1.0.4aVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.1:*:*:*:*:*:*:*1.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableThe OpenAFS Foundation
Show 71 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openafs:openafs:1.1.1a:*:*:*:*:*:*:*1.1.1aVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2:*:*:*:*:*:*:*1.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.2a:*:*:*:*:*:*:*1.2.2aVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.2b:*:*:*:*:*:*:*1.2.2bVulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.3:*:*:*:*:*:*:*1.2.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.4:*:*:*:*:*:*:*1.2.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.5:*:*:*:*:*:*:*1.2.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.6:*:*:*:*:*:*:*1.2.6VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.7:*:*:*:*:*:*:*1.2.7VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.8:*:*:*:*:*:*:*1.2.8VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.9:*:*:*:*:*:*:*1.2.9VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.10:*:*:*:*:*:*:*1.2.10VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.11:*:*:*:*:*:*:*1.2.11VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.2.13:*:*:*:*:*:*:*1.2.13VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3:*:*:*:*:*:*:*1.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.5:*:*:*:*:*:*:*1.3.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.70:*:*:*:*:*:*:*1.3.70VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.74:*:*:*:*:*:*:*1.3.74VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.77:*:*:*:*:*:*:*1.3.77VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.3.81:*:*:*:*:*:*:*1.3.81VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4:*:*:*:*:*:*:*1.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.3:*:*:*:*:*:*:*1.4.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.4:*:*:*:*:*:*:*1.4.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.5:*:*:*:*:*:*:*1.4.5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.6:*:*:*:*:*:*:*1.4.6VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7:*:*:*:*:*:*:*1.4.7VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre1:*:*:*:*:*:*:*1.4.7_pre1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre2:*:*:*:*:*:*:*1.4.7_pre2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre3:*:*:*:*:*:*:*1.4.7_pre3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre4:*:*:*:*:*:*:*1.4.7_pre4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.7_pre5:*:*:*:*:*:*:*1.4.7_pre5VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8:*:*:*:*:*:*:*1.4.8VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8_pre1:*:*:*:*:*:*:*1.4.8_pre1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8_pre2:*:*:*:*:*:*:*1.4.8_pre2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.8_pre3:*:*:*:*:*:*:*1.4.8_pre3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.4.12:*:*:*:*:*:*:*1.4.12VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.6.2.1:*:*:*:*:*:*:*1.6.2.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.6.3:*:*:*:*:*:*:*1.6.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.6.4:*:*:*:*:*:*:*1.6.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.8:*:*:*:*:*:*:*1.7.8VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.10:*:*:*:*:*:*:*1.7.10VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.11:*:*:*:*:*:*:*1.7.11VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.12:*:*:*:*:*:*:*1.7.12VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.13:*:*:*:*:*:*:*1.7.13VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.14:*:*:*:*:*:*:*1.7.14VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.15:*:*:*:*:*:*:*1.7.15VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.16:*:*:*:*:*:*:*1.7.16VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.17:*:*:*:*:*:*:*1.7.17VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.18:*:*:*:*:*:*:*1.7.18VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.19:*:*:*:*:*:*:*1.7.19VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.20:*:*:*:*:*:*:*1.7.20VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.21:*:*:*:*:*:*:*1.7.21VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.22:*:*:*:*:*:*:*1.7.22VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.23:*:*:*:*:*:*:*1.7.23VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.24:*:*:*:*:*:*:*1.7.24VulnerableThe OpenAFS Foundation
cpe:2.3:a:openafs:openafs:1.7.25:*:*:*:*:*:*:*1.7.25VulnerableThe OpenAFS Foundation
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*7.0VulnerableDebian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4134
  2. 2026-10-03 Alias added: GHSA-rj2q-26jf-jvvq

References

Sources