Skip to content
OpenAdvisories
Unscored Public exploit CVE-2012-4929 EUVD-2012-4854GHSA-348j-44v2-vwfr

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without pr…

Published Sep 15, 2012 · Updated Aug 6, 2024 · Assigned by mitre

Package: apache2 Package: lighttpd Package: nginx Package: openssl Package: pound Ecosystem: Debian

Description

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 apache2 2.2.22-12 —
Debian 14 lighttpd 1.4.30-1 —
Debian 14 nginx 1.2.1-2.2 —
Debian 14 openssl 1.0.1e-5 —
Debian 14 pound 2.6-3 —
Debian 13 apache2 2.2.22-12 —
Debian 13 lighttpd 1.4.30-1 —
Debian 13 nginx 1.2.1-2.2 —
Debian 13 openssl 1.0.1e-5 —
Debian 13 pound 2.6-3 —
Debian 12 apache2 2.2.22-12 —
Debian 12 lighttpd 1.4.30-1 —
Debian 12 nginx 1.2.1-2.2 —
Debian 12 openssl 1.0.1e-5 —
Debian 8 pound 2.6-6+deb8u1 DSA-3253-1
Debian 7 pound 2.6-2+deb7u1 DSA-3253-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 6.0 apache2 2.2.16-6+squeeze10 DSA-2579-1
Debian 6.0 lighttpd 1.4.28-2+squeeze1.2 DSA-2626-1
Debian 6.0 nginx 0.7.67-3+squeeze3 DSA-2627-1
Debian 6.0 openssl 0.9.8o-4squeeze16 DLA-0008-1
Debian 6.0 pound 2.6-1+deb6u1 DLA-400-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 openssl +3 1.0.0-27.el6_4.2 RHSA-2013:0587
RHEL 6 rhev-hypervisor6 6.4-20130306.2.el6_4 RHSA-2013:0636
RHEL 5 openssl +2 0.9.8e-26.el5_9.1 RHSA-2013:0587
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhev Manager 3 rhevm-spice-client +4 3.3-12.el6_5 RHSA-2014:0416

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed links 2.13-1.3 openSUSE-SU-2024:10531-1
openSUSE Tumbleweed lynx 2.8.8rel.2-4.13 openSUSE-SU-2024:10329-1
openSUSE Tumbleweed openssl-1_1 1.1.1l-1.2 openSUSE-SU-2024:11127-1
openSUSE Tumbleweed w3m 0.5.3.git20161120-1.1 openSUSE-SU-2024:10235-1
openSUSE Tumbleweed wget 1.18-2.3 openSUSE-SU-2024:10263-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • mpgn/CRIME-poc ★ 31 · Apr 21, 2018

    :hocho: CRIME attack PoC : a compression oracle attacks CVE-2012-4929 :hocho:

  • anthophilee/A2SV--SSL-VUL-Scan ★ 5 · Jan 1, 2021

    A2SV = Auto Scanning to SSL Vulnerability HeartBleed, CCS Injection, SSLv3 POODLE, FREAK... etc Support Vulnerability [CVE-2007-1858] Anonymous Cipher [CVE-2012-4929] CRIME(SPDY) [CVE-2014-0160] CCS …

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 16

References