GitHub Advisoryadvisory · Maven

GHSA-m26p-m559-g5j5 Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability

HIGH Published 2022-05-01 Modified 2023-09-21 Official page ↗
Aliases
CVE-2007-6721
Ecosystem
Maven
Packages
bouncycastle:bcprov-jdk14, bouncycastle:bcprov-jdk15, bouncycastle:bcprov-jdk16
Severity
High
Weaknesses
CWE-203
Reviewed
2023-09-21

Affected packages

• Maven bouncycastle:bcprov-jdk14: < 1.38 → fixed in 1.38 • Maven bouncycastle:bcprov-jdk15: < 1.38 → fixed in 1.38 • Maven bouncycastle:bcprov-jdk16: < 1.38 → fixed in 1.38

Description

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."

Related

Alias · CVE (1)

  • CVE-2007-6721 The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown… vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References