Medium severity · published Feb 21, 2020
CVE-2013-3587
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for…
5.9
CVSS
6%
EPSS
No
On KEV
Description
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.0% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Arx · F5
5.0.0 through 5.3.1; 6.0.0 through 6.4.0 · source: NVD
BA
Big-ip Access Policy Manager · F5
10.1.0 through 10.2.4; 11.0.0 through 11.6.1; 12.0.0 through 12.1.2; 13.0.0 · source: NVD
BA
Big-ip Advanced Firewall Manager · F5
11.3.0 through 11.6.1; 12.0.0 through 12.1.2; 13.0.0 · source: NVD
BA
Big-ip Analytics · F5
11.0.0 through 11.6.1; 12.0.0 through 12.1.2; 13.0.0 · source: NVD
BA
Big-ip Application Acceleration Manager · F5
11.4.0 through 11.6.1; 12.0.0 through 12.1.2; 13.0.0 · source: NVD
BA
Big-ip Application Security Manager · F5
9.2.0 through 9.4.8; 10.0.0 through 10.2.4; 11.0.0 through 11.6.1; 12.0.0 through 12.1.2; 13.0.0 · source: NVD
BE
Big-ip Edge Gateway · F5
10.1.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
BL
Big-ip Link Controller · F5
9.2.2 through 9.4.8; 10.0.0 through 10.2.4; 11.0.0 through 11.6.1; 12.0.0 through 12.1.2; 13.0.0 · source: NVD
BL
Big-ip Local Traffic Manager · F5
9.0.0 through 9.6.1; 10.0.0 through 10.2.4; 11.0.0 through 11.6.1; 12.0.0 through 12.1.2; 13.0.0 · source: NVD
BP
Big-ip Policy Enforcement Manager · F5
11.3.0 through 11.6.1; 12.0.0 through 12.1.2; 13.0.0 · source: NVD
BP
Big-ip Protocol Security Module · F5
9.4.5 through 9.4.8; 10.0.0 through 10.2.4; 11.0.0 through 11.4.1 · source: NVD
BW
Big-ip Wan Optimization Manager · F5
10.0.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3587
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3587
Third Party Advisory
http://breachattack.com/
Third Party Advisory
http://github.com/meldium/breach-mitigation-rails
Exploit
http://security.stackexchange.com/questions/20406/is-http-compression-safe#20407
Third Party Advisory
http://slashdot.org/story/13/08/05/233216
Third Party Advisory
http://www.iacr.org/cryptodb/archive/2002/FSE/3091/3091.pdf
Third Party Advisory
http://www.kb.cert.org/vuls/id/987798
More from Arx
9.8
CVE-2017-18017
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service…
9.1
CVE-2011-3188
The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes…
–
CVE-2014-2927
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before HF7, 11.3.0 before HF9, and 11.2.1 before HF11 and…