Unscored severity · published Feb 8, 2013
CVE-2013-0166
OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause…
–
CVSS
19.7%
EPSS
No
On KEV
Description
OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.
Exploitation
Is it being used?
Exploit prediction (EPSS)19.7% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openssl · Openssl
0.9.1c; 0.9.2b; 0.9.3; 0.9.3a; 0.9.4; 0.9.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0166
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0166
git.openssl.org
http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7
git.openssl.org
http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=66e8211c0b1347970096e04b18aa52567c325200
git.openssl.org
http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=ebc71865f0506a293242bd4aec97cdc7a8ef24b0
lists.apple.com
http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
More from Openssl
7.5
CVE-2014-0160
OpenSSL Information Disclosure Vulnerability
9.8
CVE-2026-63073
Untrusted Sender DN Used as Format String in CMP Response Validation
9.8
CVE-2026-31789
Heap Buffer Overflow in Hexadecimal Conversion
9.8
CVE-2022-2274
RSA implementation bug in AVX512IFMA instructions
9.8
CVE-2021-3711
SM2 Decryption Buffer Overflow