p PatchFirst

CVE-2012-4929

CVE-2012-4929

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

EPSS 4.3% · Fix available

Published
Updated

Stack: system · web · network

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • apache2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.2.22-12

    Update to 2.2.22-12

  • apache2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.2.22-12

    Update to 2.2.22-12

  • apache2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.2.22-12

    Update to 2.2.22-12

  • lighttpd Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.4.30-1

    Update to 1.4.30-1

  • lighttpd Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.4.30-1

    Update to 1.4.30-1

  • lighttpd Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.4.30-1

    Update to 1.4.30-1

  • nginx Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.2.1-2.2

    Update to 1.2.1-2.2

  • nginx Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.2.1-2.2

    Update to 1.2.1-2.2

  • nginx Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.2.1-2.2

    Update to 1.2.1-2.2

  • openssl Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.0.1e-5

    Update to 1.0.1e-5

  • openssl Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.0.1e-5

    Update to 1.0.1e-5

  • openssl Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.0.1e-5

    Update to 1.0.1e-5

  • pound Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.6-3

    Update to 2.6-3

  • pound Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.6-3

    Update to 2.6-3

Original sources

Check your server →