CVE-2013-3587

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.

CVSS v3.1

5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

6.05% chance of exploitation in the next 30 days, 93th percentile

Published

2020-02-21

Updated

2024-08-06

Proof-of-concept exploits (2)

• http://security.stackexchange.com/questions/20406/is-http-compression-safe#20407
• jselvi/docker-breach2★ · 2018-11-28

References

• CVE Record
• NVD entry

Related

• CVE-2012-4929
• CVE-2013-3586
• CVE-2013-3591
• CVE-2013-3585
• CVE-2013-3597
• CVE-2013-3576