What is CVE-2013-4165?

CVE-2013-4165 is a vulnerability in Bitcoin Core, classified under Information Disclosure. Published 2013-08-02.

Is CVE-2013-4165 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Bitcoin Core

CVE-2013-4165

The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack.

Vulnerability class: Information Disclosure

EPSS: 0.023 (81.3th percentile) — read the EPSS interpretation.

Affected products

Bitcoin Bitcoin_core — versions 0.8.1
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

References

secalert@redhat.com (x_refsource_MISC)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2013-4165?: CVE-2013-4165 is a vulnerability in Bitcoin Core, classified under Information Disclosure. Published 2013-08-02.
Is CVE-2013-4165 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.