Vulnerability in OpenSSL
CVE-2003-0131
The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.063 (93.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 93.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.063 · newest: 0.063 · change: 0.000
Affected products
- OpenSSL — versions 0.9.6, 0.9.6a, 0.9.6b
Public proof-of-concept exploits
References
- www.debian.org/security/2003/dsa-288 (vendor-advisory)
- www.redhat.com/support/errata/RHSA-2003-101.html (vendor-advisory)
- www.redhat.com/support/errata/RHSA-2003-102.html (vendor-advisory)
- marc.info/ (vendor-advisory)
- eprint.iacr.org/2003/052/ (Vendor Advisory)
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:461 (signature, vdb-entry)
- www.gentoo.org/security/en/glsa/glsa-200303-20.xml (vendor-advisory)
- lists.opensuse.org/opensuse-security-announce/2003-04/msg00005.html (vendor-advisory)
- www.securityfocus.com/bid/7148 (Patch, vdb-entry, Vendor Advisory)
- lists.apple.com/mhonarc/security-announce/msg00028.html
Frequently asked questions
- What is CVE-2003-0131?
- CVE-2003-0131 is a vulnerability in OpenSSL. Published 2003-03-24.
- Is CVE-2003-0131 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.