Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

wolfSSL CyaSSL can expose data via timing analysis

CVE-2013-1623 · published 13 years ago
Summary

Versions of wolfSSL CyaSSL prior to 2.5.0 may let remote attackers infer encrypted information by measuring how long the server takes to process specially crafted packets. The timing differences can be used to recover plaintext data. Upgrade to version 2.5.0 or later to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
yassl cyassl <= 2.4.6
0.2.0
0.3.0
0.4.0
0.5.0
0.5.5
0.6.0
0.6.2
0.6.3
0.8.0
0.9.0
0.9.6
24 more version ranges
cpe:2.3:a:yassl:cyassl:*:*:*:*:*:*:*:*
Original advisory text
The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC pad...
The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-310Cryptographic Issues
Timeline
Published8 Feb 2013
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2013-1623 · NVD
Track software like this
Free during beta