Is CVE-2013-0169 being actively exploited?

CVE-2013-0169 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2013-0169?

CVE-2013-0169 has a CVSS 2.0 base score of 2.6 (LOW).

CVE-2013-0169

LOW · CVSS 2.6EPSS 35.6%EU EUVD

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.

Key facts

CVSS score: 2.6 (v2.0)
Severity: LOW
CVSS vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Weakness (CWE): CWE-310
EPSS score: 35.6% (98th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2013-0208)
Published: February 8, 2013
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2013-0208 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.

View on the EU Vulnerability Database

Affected products

openssl / openssl
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
polarssl / polarssl
polarssl / polarssl

and 20 more…

References

http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/(Third Party Advisory)
http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html(Mailing List, Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html(Third Party Advisory)
http://marc.info/?l=bugtraq&m=136396549913849&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=136432043316835&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=136439120408139&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=136733161405818&w=2(Third Party Advisory)
http://marc.info/?l=bugtraq&m=137545771702053&w=2(Third Party Advisory)
http://openwall.com/lists/oss-security/2013/02/05/24(Mailing List)
http://rhn.redhat.com/errata/RHSA-2013-0587.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2013-0782.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2013-0783.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2013-0833.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2013-1455.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2013-1456.html(Third Party Advisory)
http://secunia.com/advisories/53623(Third Party Advisory)
http://secunia.com/advisories/55108(Third Party Advisory)
http://secunia.com/advisories/55139(Third Party Advisory)
http://secunia.com/advisories/55322(Third Party Advisory)
http://secunia.com/advisories/55350(Third Party Advisory)
http://secunia.com/advisories/55351(Third Party Advisory)
http://security.gentoo.org/glsa/glsa-201406-32.xml(Third Party Advisory)
http://support.apple.com/kb/HT5880(Third Party Advisory)
http://www-01.ibm.com/support/docview.wss?uid=swg21644047(Third Party Advisory)
http://www.debian.org/security/2013/dsa-2621(Third Party Advisory)
http://www.debian.org/security/2013/dsa-2622(Third Party Advisory)
http://www.isg.rhul.ac.uk/tls/TLStiming.pdf(Third Party Advisory)
http://www.kb.cert.org/vuls/id/737740(Third Party Advisory, US Government Resource)
http://www.mandriva.com/security/advisories?name=MDVSA-2013:095(Third Party Advisory)
http://www.matrixssl.org/news.html(Third Party Advisory)
http://www.openssl.org/news/secadv_20130204.txt(Vendor Advisory)
http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html(Third Party Advisory)
http://www.securityfocus.com/bid/57778(Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain