CVE-2013-3587
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by…
Does this matter?
Lower severity and a low EPSS score (6.05%). Track it; it rarely justifies an emergency change on its own.
Description
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 6.05% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- f5/big-ip access policy manager · f5/big-ip advanced firewall manager · f5/big-ip analytics · f5/big-ip application acceleration manager · f5/big-ip application security manager · f5/big-ip edge gateway · f5/big-ip link controller · f5/big-ip local traffic manager · f5/big-ip policy enforcement manager · f5/big-ip protocol security module · f5/big-ip wan optimization manager · f5/big-ip webaccelerator · f5/firepass · f5/arx
- Source
- cret@cert.org
References
- http://breachattack.com/Third Party Advisory
- http://github.com/meldium/breach-mitigation-railsThird Party Advisory
- http://security.stackexchange.com/questions/20406/is-http-compression-safe#20407Exploit, Third Party Advisory
- http://slashdot.org/story/13/08/05/233216Third Party Advisory
- http://www.iacr.org/cryptodb/archive/2002/FSE/3091/3091.pdfThird Party Advisory
- http://www.kb.cert.org/vuls/id/987798Third Party Advisory, US Government Resource
- https://bugzilla.redhat.com/show_bug.cgi?id=995168Issue Tracking, Third Party Advisory
- https://hackerone.com/reports/254895Exploit, Third Party Advisory
- https://lists.apache.org/thread.html/r7f0e9cfd166934172d43ca4c272b8bdda4a343036229d9937affd1e1%40%3Cdev.httpd.apache.org%3E
- https://support.f5.com/csp/article/K14634Third Party Advisory
- https://www.blackhat.com/us-13/briefings.html#PradoThird Party Advisory
- https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/Third Party Advisory
- http://breachattack.com/Third Party Advisory
- http://github.com/meldium/breach-mitigation-railsThird Party Advisory
- http://security.stackexchange.com/questions/20406/is-http-compression-safe#20407Exploit, Third Party Advisory
- http://slashdot.org/story/13/08/05/233216Third Party Advisory
- http://www.iacr.org/cryptodb/archive/2002/FSE/3091/3091.pdfThird Party Advisory
- http://www.kb.cert.org/vuls/id/987798Third Party Advisory, US Government Resource
- https://bugzilla.redhat.com/show_bug.cgi?id=995168Issue Tracking, Third Party Advisory
- https://hackerone.com/reports/254895Exploit, Third Party Advisory
- https://lists.apache.org/thread.html/r7f0e9cfd166934172d43ca4c272b8bdda4a343036229d9937affd1e1%40%3Cdev.httpd.apache.org%3E
- https://support.f5.com/csp/article/K14634Third Party Advisory
- https://www.blackhat.com/us-13/briefings.html#PradoThird Party Advisory
- https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.