NetSight
IP …
medium5.9

CVE-2013-3587

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which…

Impact

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.

Affected products

VendorProductAffected versions
F5Big-Ip Access Policy Manager
from 10.1.0 through 10.2.4
from 11.0.0 through 11.6.1
from 12.0.0 through 12.1.2
Version 13.0.0
F5Big-Ip Advanced Firewall Manager
from 11.3.0 through 11.6.1
from 12.0.0 through 12.1.2
Version 13.0.0
F5Big-Ip Analytics
from 11.0.0 through 11.6.1
from 12.0.0 through 12.1.2
Version 13.0.0
F5Big-Ip Application Acceleration Manager
from 11.4.0 through 11.6.1
from 12.0.0 through 12.1.2
Version 13.0.0
F5Big-Ip Application Security Manager
from 9.2.0 through 9.4.8
from 10.0.0 through 10.2.4
from 11.0.0 through 11.6.1
from 12.0.0 through 12.1.2
Version 13.0.0
F5Big-Ip Edge Gateway
from 10.1.0 through 10.2.4
from 11.0.0 through 11.3.0
F5Big-Ip Link Controller
from 9.2.2 through 9.4.8
from 10.0.0 through 10.2.4
from 11.0.0 through 11.6.1
from 12.0.0 through 12.1.2
Version 13.0.0
F5Big-Ip Local Traffic Manager
from 9.0.0 through 9.6.1
from 10.0.0 through 10.2.4
from 11.0.0 through 11.6.1
from 12.0.0 through 12.1.2
Version 13.0.0
F5Big-Ip Policy Enforcement Manager
from 11.3.0 through 11.6.1
from 12.0.0 through 12.1.2
Version 13.0.0
F5Big-Ip Protocol Security Module
from 9.4.5 through 9.4.8
from 10.0.0 through 10.2.4
from 11.0.0 through 11.4.1
F5Big-Ip Wan Optimization Manager
from 10.0.0 through 10.2.4
from 11.0.0 through 11.3.0
F5Big-Ip Webaccelerator
from 9.4.0 through 9.4.8
from 10.0.0 through 10.2.4
from 11.0.0 through 11.3.0

Weakness classification

CWE-200

References