What’s Vulnerable › Vulnerabilities
CVE-2013-3587
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-02-21 · updated 2026-06-16
- Weakness: CWE-200
Description
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.
Affected products
- F5 Arx: from 5.0.0 through 5.3.1; from 6.0.0 through 6.4.0
- F5 BIG-IP APM: from 10.1.0 through 10.2.4; from 11.0.0 through 11.6.1; from 12.0.0 through 12.1.2; 13.0.0
- BIG-IP: from 11.3.0 through 11.6.1; from 12.0.0 through 12.1.2; 13.0.0
- F5 Big-Ip Analytics: from 11.0.0 through 11.6.1; from 12.0.0 through 12.1.2; 13.0.0
- F5 Networks, Inc. BIG-IP (AAM): from 11.4.0 through 11.6.1; from 12.0.0 through 12.1.2; 13.0.0
- BIG-IP ASM: from 9.2.0 through 9.4.8; from 10.0.0 through 10.2.4; from 11.0.0 through 11.6.1; from 12.0.0 through 12.1.2; 13.0.0
- F5 Big-Ip Edge Gateway: from 10.1.0 through 10.2.4; from 11.0.0 through 11.3.0
- F5 Big-Ip Link Controller: from 9.2.2 through 9.4.8; from 10.0.0 through 10.2.4; from 11.0.0 through 11.6.1; from 12.0.0 through 12.1.2; 13.0.0
- F5 BIG-IP (LTM): from 9.0.0 through 9.6.1; from 10.0.0 through 10.2.4; from 11.0.0 through 11.6.1; from 12.0.0 through 12.1.2; 13.0.0
- F5 Networks, Inc. BIG-IP (PEM): from 11.3.0 through 11.6.1; from 12.0.0 through 12.1.2; 13.0.0
- F5 Big-Ip Protocol Security Module: from 9.4.5 through 9.4.8; from 10.0.0 through 10.2.4; from 11.0.0 through 11.4.1
- F5 Big-Ip Wan Optimization Manager: from 10.0.0 through 10.2.4; from 11.0.0 through 11.3.0
- F5 Big-Ip Webaccelerator: from 9.4.0 through 9.4.8; from 10.0.0 through 10.2.4; from 11.0.0 through 11.3.0
- F5 Firepass: from 6.0.0 through 6.1.0; 7.0.0
References
- http://breachattack.com/
- http://github.com/meldium/breach-mitigation-rails
- http://security.stackexchange.com/questions/20406/is-http-compression-safe#20407
- http://slashdot.org/story/13/08/05/233216
- http://www.iacr.org/cryptodb/archive/2002/FSE/3091/3091.pdf
- http://www.kb.cert.org/vuls/id/987798
- https://bugzilla.redhat.com/show_bug.cgi?id=995168
- https://hackerone.com/reports/254895
- https://lists.apache.org/thread.html/r7f0e9cfd166934172d43ca4c272b8bdda4a343036229d9937affd1e1%40%3Cdev.httpd.apache.org%3E
- https://support.f5.com/csp/article/K14634
- https://www.blackhat.com/us-13/briefings.html#Prado
- https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/
Get alerted when CVE-2013-3587 or the next vulnerability affects your stack