VA scan shows LUCKY13 Vulnerability for our Managed component

LucaGalliani — Wed, 17 Apr 2024 15:12:21 GMT

Self Service Summary

Some customers have detected exposure to the "LUCKY13 Vulnerability attack" in their VA scans for our Managed component.
Also known as CVE-2013-0169, this vulnerability has been analyzed and fixed.

We are not affected, there is no risk that the “Lucky13” can be exploited on our systems.

Issue

Solution

Tasks

Alternative(s)

LUCKY13 Vulnerability attack

We are not affected.

Check below information and explain it to your Security Team

The implementations used by Dynatrace are all up to date and contain the corresponding patches.

Please submit a Support ticket if you have additional questions or concerns.

The use of cipher suites for TLS that operate in CBC mode can be considered an issue if the underlying implementation is not protected against this kind of attack.

The “Lucky13” timing attack was found in 2013 and, as also stated in NVD - CVE-2013-0169, has since been mitigated in several libraries like: OpenSSL, PolarSSL, Mozilla NSS, gnuTLS, BouncyCastle, and basically all other industry-relevant libraries used for cryptographic purposes.

article VA scan shows LUCKY13 Vulnerability for our Managed component in Troubleshooting

VA scan shows LUCKY13 Vulnerability for our Managed component

Self Service Summary