bouncycastle bouncy castle for java vulnerabilities and exploits

(subscribe to this query)

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserializat...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api Netapp Oncommand Workflow Automation -Opensuse Leap 15.1 Oracle Retail Xstore Point Of Service 7.1 Oracle Api Gateway 11.1.2.4.0 Oracle Enterprise Repository 12.1.3.0.0 Oracle Retail Xstore Point Of Service 7.0 Oracle Enterprise Repository 11.1.1.7.0 Oracle Peoplesoft Enterprise Peopletools 8.55 Oracle Peoplesoft Enterprise Peopletools 8.56 Oracle Communications Webrtc Session Controller 7.2 Oracle Webcenter Portal 12.2.1.3.0 Oracle Webcenter Portal 11.1.1.9.0 Oracle Weblogic Server 12.2.1.3 Oracle Business Process Management Suite 12.1.3.0.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 11.1.1.9.0 Oracle Soa Suite 12.1.3.0.0 Oracle Soa Suite 12.2.1.3.0 Oracle Peoplesoft Enterprise Peopletools 8.57 Oracle Managed File Transfer 12.2.1.3.0 Oracle Communications Converged Application Server

1 Github repository

In the Bouncy Castle JCE Provider version 1.55 and previous versions the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api

In the Bouncy Castle JCE Provider version 1.55 and previous versions the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and previous versions have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fi...

Bouncycastle Fips Java Api Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api Debian Debian Linux 9.0 Oracle Retail Xstore Point Of Service 7.1 Oracle Api Gateway 11.1.2.4.0 Oracle Weblogic Server 12.1.3.0.0 Oracle Enterprise Repository 12.1.3.0.0 Oracle Retail Xstore Point Of Service 7.0 Oracle Peoplesoft Enterprise Peopletools 8.55 Oracle Peoplesoft Enterprise Peopletools 8.56 Oracle Webcenter Portal 12.2.1.3.0 Oracle Webcenter Portal 11.1.1.9.0 Oracle Business Process Management Suite 12.1.3.0.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 11.1.1.9.0 Oracle Soa Suite 12.1.3.0.0 Oracle Soa Suite 12.2.1.3.0 Oracle Peoplesoft Enterprise Peopletools 8.57 Oracle Managed File Transfer 12.2.1.3.0 Oracle Communications Converged Application Server Oracle Communications Webrtc Session Controller Oracle Retail Convenience And Fuel Pos Software 2.8.1

1 Github repository

The Bouncy Castle Java library prior to 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote malicious users to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve att...

Opensuse Leap 42.1 Opensuse Opensuse 13.1 Opensuse Opensuse 13.2 Bouncycastle Bouncy Castle Crypto Package Oracle Peoplesoft Enterprise Peopletools 8.54 Oracle Virtual Desktop Infrastructure 3.5.2 Oracle Enterprise Manager Ops Center 12.2.2 Oracle Application Testing Suite 12.5.0.2 Oracle Application Testing Suite 12.5.0.1 Oracle Enterprise Manager Ops Center 12.1.4 Oracle Application Testing Suite 12.5.0.3 Oracle Peoplesoft Enterprise Peopletools 8.55

Bouncy Castle BC Java prior to 1.66, BC C# .NET prior to 1.8.7, BC-FJA prior to 1.0.1.2, 1.0.2.1, and BC-FNA prior to 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information fo...

Bouncycastle Legion-of-the-bouncy-castle-fips-java-api Bouncycastle Bc-csharp Bouncycastle Bouncy Castle Fips .net Api Bouncycastle The Bouncy Castle Crypto Package For Java

2 Github repositories

In the Bouncy Castle JCE Provider version 1.55 and previous versions the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryptio...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api Debian Debian Linux 8.0

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a ...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api

The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for malicious users to defeat a cryptographic protection mechanism and discover an authentication key via a crafted applicati...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.54 Google Android 5.1.0 Google Android 6.0.1 Google Android 6.0 Google Android 5.0.1 Google Android 5.0 Google Android 5.1

The TLS implementation in the Bouncy Castle Java library prior to 1.48 and C# library prior to 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote malicious users to c...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.25 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.40 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.43 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.08 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.20 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.17 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.15 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.42 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.32 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.27 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.41 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.14 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.01 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.30 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.21 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.04 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.07 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.19 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.39 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.23 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.02 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.45

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook