CVE-2013-3587 The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle at...
MediumCVSS 5.9
EPSS 6.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 big-ip access policy manager | >= 10.1.0, <= 10.2.4 | No fix listed |
| f5 big-ip access policy manager | >= 11.0.0, <= 11.6.1 | No fix listed |
| f5 big-ip access policy manager | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip access policy manager | = 13.0.0 | No fix listed |
| f5 big-ip advanced firewall manager | >= 11.3.0, <= 11.6.1 | No fix listed |
| f5 big-ip advanced firewall manager | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip advanced firewall manager | = 13.0.0 | No fix listed |
| f5 big-ip analytics | >= 11.0.0, <= 11.6.1 | No fix listed |
| f5 big-ip analytics | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip analytics | = 13.0.0 | No fix listed |
| f5 big-ip application acceleration manager | >= 11.4.0, <= 11.6.1 | No fix listed |
| f5 big-ip application acceleration manager | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip application acceleration manager | = 13.0.0 | No fix listed |
| f5 big-ip application security manager | >= 9.2.0, <= 9.4.8 | No fix listed |
| f5 big-ip application security manager | >= 10.0.0, <= 10.2.4 | No fix listed |
| f5 big-ip application security manager | >= 11.0.0, <= 11.6.1 | No fix listed |
| f5 big-ip application security manager | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip application security manager | = 13.0.0 | No fix listed |
| f5 big-ip edge gateway | >= 10.1.0, <= 10.2.4 | No fix listed |
| f5 big-ip edge gateway | >= 11.0.0, <= 11.3.0 | No fix listed |
| f5 big-ip link controller | >= 9.2.2, <= 9.4.8 | No fix listed |
| f5 big-ip link controller | >= 10.0.0, <= 10.2.4 | No fix listed |
| f5 big-ip link controller | >= 11.0.0, <= 11.6.1 | No fix listed |
| f5 big-ip link controller | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip link controller | = 13.0.0 | No fix listed |
Show 20 more
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 big-ip local traffic manager | >= 9.0.0, <= 9.6.1 | No fix listed |
| f5 big-ip local traffic manager | >= 10.0.0, <= 10.2.4 | No fix listed |
| f5 big-ip local traffic manager | >= 11.0.0, <= 11.6.1 | No fix listed |
| f5 big-ip local traffic manager | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip local traffic manager | = 13.0.0 | No fix listed |
| f5 big-ip policy enforcement manager | >= 11.3.0, <= 11.6.1 | No fix listed |
| f5 big-ip policy enforcement manager | >= 12.0.0, <= 12.1.2 | No fix listed |
| f5 big-ip policy enforcement manager | = 13.0.0 | No fix listed |
| f5 big-ip protocol security module | >= 9.4.5, <= 9.4.8 | No fix listed |
| f5 big-ip protocol security module | >= 10.0.0, <= 10.2.4 | No fix listed |
| f5 big-ip protocol security module | >= 11.0.0, <= 11.4.1 | No fix listed |
| f5 big-ip wan optimization manager | >= 10.0.0, <= 10.2.4 | No fix listed |
| f5 big-ip wan optimization manager | >= 11.0.0, <= 11.3.0 | No fix listed |
| f5 big-ip webaccelerator | >= 9.4.0, <= 9.4.8 | No fix listed |
| f5 big-ip webaccelerator | >= 10.0.0, <= 10.2.4 | No fix listed |
| f5 big-ip webaccelerator | >= 11.0.0, <= 11.3.0 | No fix listed |
| f5 firepass | >= 6.0.0, <= 6.1.0 | No fix listed |
| f5 firepass | = 7.0.0 | No fix listed |
| f5 arx | >= 5.0.0, <= 5.3.1 | No fix listed |
| f5 arx | >= 6.0.0, <= 6.4.0 | No fix listed |
References
- breachattack.com third-party-advisory
- github.com third-party-advisory
- security.stackexchange.com exploit third-party-advisory
- slashdot.org third-party-advisory
- www.iacr.org third-party-advisory
- www.kb.cert.org third-party-advisory us-government-resource
- bugzilla.redhat.com issue-tracking third-party-advisory
- hackerone.com exploit third-party-advisory
- [httpd-dev] 20210409 GSOC project Idea- fix for CVE-2013-3587 mailing-list
- support.f5.com third-party-advisory
- www.blackhat.com third-party-advisory
- www.djangoproject.com third-party-advisory