|The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as
used in OpenSSL, OpenJDK, PolarSSL, and other products, do not
properly consider timing side-channel attacks on a MAC check
requirement during the processing of malformed CBC padding, which
allows remote attackers to conduct distinguishing attacks and
plaintext-recovery attacks via statistical analysis of timing data for
crafted packets, aka the "Lucky Thirteen" issue.