CVE-2013-0166

medium · 5

OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.

CVSS

19.7%

EPSS (exploit prob.)

97th

EPSS percentile

2013-02-08

Published

AV:N/AC:L/Au:N/C:N/I:N/A:P

Weaknesses

CWE-310

Affected products

Vendor	Product	Affected versions
openssl	openssl	0.9.1c
openssl	openssl	0.9.2b
openssl	openssl	0.9.3
openssl	openssl	0.9.3a
openssl	openssl	0.9.4
openssl	openssl	0.9.5
openssl	openssl	0.9.5
openssl	openssl	0.9.5
openssl	openssl	0.9.5a
openssl	openssl	0.9.5a
openssl	openssl	0.9.5a
openssl	openssl	0.9.6
openssl	openssl	0.9.6
openssl	openssl	0.9.6
openssl	openssl	0.9.6
openssl	openssl	0.9.6a
openssl	openssl	0.9.6a
openssl	openssl	0.9.6a
openssl	openssl	0.9.6a
openssl	openssl	0.9.6b
openssl	openssl	0.9.6c
openssl	openssl	0.9.6d
openssl	openssl	0.9.6e
openssl	openssl	0.9.6f
openssl	openssl	0.9.6g
openssl	openssl	0.9.6h
openssl	openssl	0.9.6i
openssl	openssl	0.9.6j
openssl	openssl	0.9.6k
openssl	openssl	0.9.6l
openssl	openssl	0.9.6m
openssl	openssl	0.9.7
openssl	openssl	0.9.7
openssl	openssl	0.9.7
openssl	openssl	0.9.7
openssl	openssl	0.9.7
openssl	openssl	0.9.7
openssl	openssl	0.9.7
openssl	openssl	0.9.7a
openssl	openssl	0.9.7b

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-0166