bouncycastle legion-of-the-bouncy-castle-java-crytography-api vulnerabilities and exploits

(subscribe to this query)

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package prior to 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.01 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.02 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.03 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.04 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.05 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.06 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.07 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.08 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.09 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.10 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.11 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.12 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.13 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.14 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.15 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.16 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.17 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.18 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.19 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.20 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.21

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserializat...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api Netapp Oncommand Workflow Automation -Opensuse Leap 15.1 Oracle Retail Xstore Point Of Service 7.1 Oracle Api Gateway 11.1.2.4.0 Oracle Enterprise Repository 12.1.3.0.0 Oracle Retail Xstore Point Of Service 7.0 Oracle Enterprise Repository 11.1.1.7.0 Oracle Peoplesoft Enterprise Peopletools 8.55 Oracle Peoplesoft Enterprise Peopletools 8.56 Oracle Communications Webrtc Session Controller 7.2 Oracle Webcenter Portal 12.2.1.3.0 Oracle Webcenter Portal 11.1.1.9.0 Oracle Weblogic Server 12.2.1.3 Oracle Business Process Management Suite 12.1.3.0.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 11.1.1.9.0 Oracle Soa Suite 12.1.3.0.0 Oracle Soa Suite 12.2.1.3.0 Oracle Peoplesoft Enterprise Peopletools 8.57 Oracle Managed File Transfer 12.2.1.3.0 Oracle Communications Converged Application Server

1 Github repository

An issue exists in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.66 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.65 Apache Karaf 4.3.2 Oracle Peoplesoft Enterprise Peopletools 8.56 Oracle Webcenter Portal 12.2.1.3.0 Oracle Webcenter Portal 11.1.1.9.0 Oracle Peoplesoft Enterprise Peopletools 8.57 Oracle Utilities Framework 4.3.0.6.0 Oracle Utilities Framework 4.4.0.0.0 Oracle Peoplesoft Enterprise Peopletools 8.58 Oracle Webcenter Portal 12.2.1.4.0 Oracle Utilities Framework 4.4.0.2.0 Oracle Banking Extensibility Workbench 14.3.0 Oracle Banking Virtual Account Management 14.3.0 Oracle Banking Credit Facilities Process Management 14.3.0 Oracle Banking Corporate Lending Process Management 14.3.0 Oracle Communications Messaging Server 8.1 Oracle Commerce Guided Search 11.3.2 Oracle Communications Messaging Server 8.0.2 Oracle Utilities Framework 4.4.0.3.0 Oracle Communications Cloud Native Core Network Slice Selection Function 1.2.1 Oracle Communications Pricing Design Center 12.0.0.3.0

2 Github repositories

In the Bouncy Castle JCE Provider version 1.55 and previous versions the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api

In the Bouncy Castle JCE Provider version 1.55 and previous versions the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a ...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

In Bouncy Castle JCE Provider version 1.55 and previous versions the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow ...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and previous versions have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fi...

Bouncycastle Fips Java Api Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api Debian Debian Linux 9.0 Oracle Retail Xstore Point Of Service 7.1 Oracle Api Gateway 11.1.2.4.0 Oracle Weblogic Server 12.1.3.0.0 Oracle Enterprise Repository 12.1.3.0.0 Oracle Retail Xstore Point Of Service 7.0 Oracle Peoplesoft Enterprise Peopletools 8.55 Oracle Peoplesoft Enterprise Peopletools 8.56 Oracle Webcenter Portal 12.2.1.3.0 Oracle Webcenter Portal 11.1.1.9.0 Oracle Business Process Management Suite 12.1.3.0.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 11.1.1.9.0 Oracle Soa Suite 12.1.3.0.0 Oracle Soa Suite 12.2.1.3.0 Oracle Peoplesoft Enterprise Peopletools 8.57 Oracle Managed File Transfer 12.2.1.3.0 Oracle Communications Converged Application Server Oracle Communications Webrtc Session Controller Oracle Retail Convenience And Fuel Pos Software 2.8.1

1 Github repository

In the Bouncy Castle JCE Provider version 1.55 and previous versions the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryptio...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api Debian Debian Linux 8.0

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook