bouncycastle vulnerabilities and exploits

(subscribe to this query)

NA

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package prior to 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.31 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.30 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.29 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.22 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.21 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.14 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.13 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.05 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.04 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.33 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.32 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.23 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.24 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.16 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.15 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.08 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.07 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.06 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.36 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.28 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.27 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.20

5.9

CVSSv3

Bouncy Castle BC Java prior to 1.66, BC C# .NET prior to 1.8.7, BC-FJA prior to 1.0.1.2, 1.0.2.1, and BC-FNA prior to 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information fo...

Bouncycastle Bc-csharp Bouncycastle Bouncy Castle Fips .net Api Bouncycastle Legion-of-the-bouncy-castle-fips-java-api Bouncycastle The Bouncy Castle Crypto Package For Java

2 Github repositories

NA

The TLS implementation in the Bouncy Castle Java library prior to 1.48 and C# library prior to 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote malicious users to c...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.12 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.11 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.20 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.17 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.04 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.03 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.08 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.07 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.06 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.16 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.13 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.23 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.24 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.32 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.31 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.43 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.44 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.02 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.01 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.05 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.19 Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api 1.14

5.5

CVSSv3

An issue exists in the FIPS Java API of Bouncy Castle BC-FJA prior to 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by t...

Bouncycastle Fips Java Api

5.3

CVSSv3

In Legion of the Bouncy Castle BC prior to 1.61 and BC-FJA prior to 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending i...

Bouncycastle Legion-of-the-bouncy-castle-fips-java-api Bouncycastle Legion-of-the-bouncy-castle

1 Github repository

5.3

CVSSv3

Bouncy Castle For Java prior to 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the cert...

Bouncycastle Bc-java

5.5

CVSSv3

Bouncy Castle for Java prior to 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a...

Bouncycastle Bouncy Castle For Java

5.9

CVSSv3

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a ...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api

7.5

CVSSv3

In Bouncy Castle JCE Provider version 1.55 and previous versions the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow ...

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api

7.4

CVSSv3

In the Bouncy Castle JCE Provider version 1.55 and previous versions the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook