WaratekVRT Sign in

CVE-2013-0169

Affected software2 products, listed below
Severity2.6 Low CVSS 2.0
WeaknessCWE-310
Published8 Feb 2013
Updated16 Jun 2026

Description

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed, none at 5+ stars
  • EPSS 36% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Exploit for cve-2013-0169 4 2025-04-01

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2013 ↗ CPU 2013-Q4 Oracle Database Server / Oracle Security Service (11.1.0.7, 11.2.0.2, 11.2.0.3, 12.1.0.1)
Oracle Fusion Middleware / Oracle Security Service (FMW: 11.1.1.6, 11.1.1.7 Forms: 11.1.2.1 OHS: 12.1.2)
Java SE CPU Feb 2013 ↗ CPU 2013-Q1 Oracle Java SE / Java Runtime Environment (7 Update 13 and before, 6 Update 39 and before, 5.0 Update 39 and before, 1.4.2_41 and before)
Oracle's note: Applies to server deployments of JSSE. SSL/TLS Plaintext Recovery vulnerability also known as "Lucky Thirteen" vulnerability.

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Database Server Oracle Security Service 11.1.0.7, 11.2.0.2, 11.2.0.3, 12.1.0.1 11.1.0.7 · 11.2.0.2 · 11.2.0.3 · 12.1.0.1
Oracle Fusion Middleware Oracle Security Service FMW: 11.1.1.6, 11.1.1.7 Forms: 11.1.2.1 OHS: 12.1.2 11.1.1.6 · 11.1.1.7.11.1
Oracle Java SE Java Runtime Environment 7 Update 13 and before, 6 Update 39 and before, 5.0 Update 39 and before, 1.4.2_41 and before

Products and versions

3 products, 72 version entries
SourceVendorProductSchemeAffected versions
nvd openssl openssl generic ≥ 0.9.8 and ≤ 0.9.8 · ≥ 1.0.0 and ≤ 1.0.0 · ≥ 1.0.1 and ≤ 1.0.1
nvd oracle openjdk javase 1.6.0 · 1.6.0:update1 · 1.6.0:update2 · 1.6.0:update3 · 1.6.0:update4 · 1.6.0:update5 · 1.6.0:update6 · 1.6.0:update7 · 1.6.0:update10 · 1.6.0:update11 · 1.6.0:update12 · 1.6.0:update13 · 1.6.0:update14 · 1.6.0:update15 · 1.6.0:update16 · 1.6.0:update17 · 1.6.0:update18 · 1.6.0:update19 · 1.6.0:update20 · 1.6.0:update21 · 1.6.0:update22 · 1.6.0:update23 · 1.6.0:update24 · 1.6.0:update25 · 1.6.0:update26 · 1.6.0:update27 · 1.6.0:update29 · 1.6.0:update30 · 1.6.0:update31 · 1.6.0:update32 · 1.6.0:update33 · 1.6.0:update34 · 1.6.0:update35 · 1.6.0:update37 · 1.6.0:update38 · 1.7.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 · 1.7.0:update7 · 1.7.0:update9 · 1.7.0:update10 · 1.7.0:update11 · 1.7.0:update13
nvd polarssl polarssl generic 0.10.0 · 0.10.1 · 0.11.0 · 0.11.1 · 0.12.0 · 0.12.1 · 0.13.1 · 0.14.0 · 0.14.2 · 0.14.3 · 0.99:pre1 · 0.99:pre3 · 0.99:pre4 · 0.99:pre5 · 1.0.0 · 1.1.0 · 1.1.0:rc0 · 1.1.0:rc1 · 1.1.1 · 1.1.2 · 1.1.3 · 1.1.4

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** SSL/TLS, NO AUTH REMOTE EXPLOIT, JSSE, SEE NOTE 2 **Products:** SSL/TLS

References

URLTags
https://access.redhat.com/errata/RHSA-2013:0273 ADVISORY, RHSA-2013:0273
https://access.redhat.com/security/cve/CVE-2013-0169 REPORT, RHSA-2013:0273
https://access.redhat.com/errata/RHSA-2013:0274 ADVISORY, RHSA-2013:0274
https://access.redhat.com/errata/RHSA-2013:0275 ADVISORY, RHSA-2013:0275
http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/ Third Party Advisory
http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html Mailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html Third Party Advisory

Timeline
Published2013-02-08By the CVE Program.
NVD record modified2026-06-16NVD's own last-modified date for this record.