CVE-2003-0078

medium

Description

ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack."

References

Advisories
More

http://marc.info/?l=bugtraq&m=104577183206905&w=2

http://marc.info/?l=bugtraq&m=104568426824439&w=2

http://marc.info/?l=bugtraq&m=104567627211904&w=2

https://euvd.enisa.europa.eu/vulnerability/EUVD-2003-0074

http://www.trustix.org/errata/2003/0005

http://www.securityfocus.com/bid/6884

http://www.redhat.com/support/errata/RHSA-2003-205.html

http://www.redhat.com/support/errata/RHSA-2003-104.html

http://www.redhat.com/support/errata/RHSA-2003-082.html

http://www.redhat.com/support/errata/RHSA-2003-063.html

http://www.redhat.com/support/errata/RHSA-2003-062.html

http://www.osvdb.org/3945

http://www.openssl.org/news/secadv_20030219.txt

http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:020

http://www.linuxsecurity.com/advisories/engarde_advisory-2874.html

http://www.iss.net/security_center/static/11369.php

http://www.debian.org/security/2003/dsa-253

http://www.ciac.org/ciac/bulletins/n-051.shtml

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000570

Details

Source: Mitre, NVD

Published: 2003-03-03

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: Medium

EPSS

EPSS: 0.13718