oss-security - CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <201302051034.24049.mweckbecker@suse.de>
Date: Tue, 5 Feb 2013 10:34:23 +0100
From: Matthias Weckbecker <mweckbecker@...e.de>
To: oss-security@...ts.openwall.com
Cc: nadhem.alfardan.2009@...l.ac.uk, kenny.paterson@...l.ac.uk
Subject: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations

Hi,

has there already been a CVE assigned for the recent "lucky 13" timing
flaw that affects various SSL / TLS implementations (including GnuTLS)?

  http://www.isg.rhul.ac.uk/tls/
  http://www.gnutls.org/security.html#GNUTLS-SA-2013-1

I think this could qualify for CVE for each open source implementation
that's prone.

Thanks,
Matthias

-- 
Matthias Weckbecker, Senior Security Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0;  http://suse.com/
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.