Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2013-1624

14
FAUCET Score

CVE-2013-1624 describes a timing side-channel vulnerability in the TLS implementation of Bouncy Castle Java library versions prior to 1.48 and C# library versions prior to 1.8. This flaw, related to CVE-2013-0169, stems from improper handling of malformed CBC padding during MAC checks. Attackers can exploit this by statistically analyzing timing data from crafted packets to conduct distinguishing and plaintext-recovery attacks. Rated with a CVSS score of 4.0, this vulnerability has a network attack vector and high attack complexity, potentially leading to partial confidentiality and integrity compromise. The EPSS score is very low, indicating a minimal likelihood of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also absent, suggesting a low level of attention to this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
1.01CPE matchmatch criteria
cpe:2.3:a:bouncycastle:bc-java:1.01:*:*:*:*:*:*:*
1.02CPE matchmatch criteria
cpe:2.3:a:bouncycastle:bc-java:1.02:*:*:*:*:*:*:*
1.03CPE matchmatch criteria
cpe:2.3:a:bouncycastle:bc-java:1.03:*:*:*:*:*:*:*
1.04CPE matchmatch criteria
cpe:2.3:a:bouncycastle:bc-java:1.04:*:*:*:*:*:*:*
1.05CPE matchmatch criteria
cpe:2.3:a:bouncycastle:bc-java:1.05:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

4.0MEDIUM

AV:N/AC:H/Au:N/C:P/I:P/A:N

Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Exploitability Score
4.9
Impact Score
4.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
2.97%
Probability of exploitation in next 30 days
EPSS Percentile
85.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0297 is in the 79th percentile among its peer group of 19,958 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (15)

mavenpatch availablevia ghsa
Product: org.bouncycastle:bcprov-jdk15onFixed in: 1.48
redhatpatch availablevia redhat_api
Product: Red Hat JBoss BRMS 6.0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Fuse 6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss BPMS 6.0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Portal 6.2Fixed in: bouncycastle
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Web Framework Kit 2.6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss A-MQ 6.1
View patch
redhatno patchvia redhat_api
Product: Red Hat JBoss Fuse 6Fixed in: jruby
redhatno patchvia redhat_api
Product: Red Hat JBoss BRMS 6Fixed in: bouncycastle
redhatno patchvia redhat_api
Product: Red Hat BPM Suite 6Fixed in: bouncycastle
redhatend of lifevia redhat_api
Product: Red Hat Subscription Asset ManagerFixed in: bouncycastle
redhatend of lifevia redhat_api
Product: OpenShift Enterprise 1Fixed in: bouncycastle
redhatend of lifevia redhat_api
Product: Red Hat JBoss BRMS 5Fixed in: bouncycastle
redhatend of lifevia redhat_api
Product: Red Hat JBoss Portal 5Fixed in: bouncycastle
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Enterprise 2Fixed in: bouncycastle

Vendor Advisories (2)

mavenGHSA-8353-fgcr-xfhxmedium

Improper Input Validation in Bouncy Castle

May 14, 2022
redhatCVE-2013-1624Moderate

bouncycastle: TLS CBC padding timing attack

Feb 4, 2013

References

openwall.com / lists/oss-security/2013/02/05/24
rhn.redhat.com / errata/RHSA-2014-0371.html
rhn.redhat.com / errata/RHSA-2014-0372.html
secunia.com / advisories/57716
secunia.com / advisories/57719
isg.rhul.ac.uk / tls/TLStiming.pdf