CVEvulnerability

CVE-2019-3738

6.5 MEDIUM Published 2019-09-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-09-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-325, CWE-347

Description

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.

Affected configurations

• dell bsafe cert-j (<= 6.2.4) • dell bsafe crypto-j (< 6.2.5) • dell bsafe ssl-j (<= 6.2.4.1) • mcafee threat intelligence exchange server (>= 2.0.0 <= 2.3.1) • mcafee threat intelligence exchange server 3.0.0 • oracle application performance management 13.3.0.0 • oracle application performance management 13.4.0.0 • oracle communications network integrity 7.3.2 • oracle communications network integrity 7.3.5 • oracle communications network integrity 7.3.6 • oracle communications unified inventory management 7.3.2 • oracle communications unified inventory management 7.3.4 • oracle communications unified inventory management 7.3.5 • oracle communications unified inventory management 7.4.0 • oracle communications unified inventory management 7.4.1 • oracle database 12.1.0.2 • oracle database 12.2.0.1 • oracle database 18c • oracle database 19c • oracle goldengate (< 19.1.0.0.0.210420) • oracle goldengate 19.1.0.0.0.210420 • oracle retail assortment planning 15.0.3.0 • oracle retail assortment planning 16.0.3.0 • oracle retail integration bus 14.1 • oracle retail integration bus 15.0 • oracle retail integration bus 16.0 • oracle retail predictive application server 14.1.3.0 • oracle retail predictive application server 15.0.3.0 • oracle retail predictive application server 16.0.3.0 • oracle retail service backbone 14.1 • oracle retail service backbone 15.0 • oracle retail service backbone 16.0 • oracle retail store inventory management 14.0.4 • oracle retail store inventory management 14.1.3 • oracle retail store inventory management 15.0.3 • oracle retail store inventory management 16.0.3 • oracle retail xstore point of service 15.0.3 • oracle retail xstore point of service 16.0.5 • oracle retail xstore point of service 17.0.3 • oracle retail xstore point of service 18.0.2 • oracle retail xstore point of service 19.0.1 • oracle storagetek tape analytics sw tool 2.3

Related

Weakness · CWE (2)

  • CWE-325 Missing Cryptographic Step weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References