Lucene search

[email protected]CVE-2019-3740

HistorySep 18, 2019 - 11:15 p.m.

CVE-2019-3740

2019-09-1823:15:11

CWE-203

CWE-310

[email protected]

web.nvd.nist.gov

201

cve-2019-3740

rsa bsafe crypto-j

information exposure

timing discrepancy

dsa key generation

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

7.9 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.5%

JSON

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.

Affected configurations

NVD

Node

dellbsafe_cert-jRange≤6.2.4

dellbsafe_crypto-jRange<6.2.5

dellbsafe_ssl-jRange≤6.2.4.1

Node

oracleapplication_performance_managementMatch13.3.0.0

oracleapplication_performance_managementMatch13.4.0.0

oraclecommunications_network_integrityMatch7.3.2

oraclecommunications_network_integrityMatch7.3.5

oraclecommunications_network_integrityMatch7.3.6

oraclecommunications_unified_inventory_managementMatch7.3.2

oraclecommunications_unified_inventory_managementMatch7.3.4

oraclecommunications_unified_inventory_managementMatch7.3.5

oraclecommunications_unified_inventory_managementMatch7.4.0

oraclecommunications_unified_inventory_managementMatch7.4.1

oracledatabaseMatch12.1.0.2enterprise

oracledatabaseMatch12.2.0.1enterprise

oracledatabaseMatch18centerprise

oracledatabaseMatch19centerprise

oracleglobal_lifecycle_management_opatchRange<12.2.0.1.22

oraclegoldengateRange<19.1.0.0.0.210420

oracleretail_assortment_planningMatch15.0.3.0

oracleretail_assortment_planningMatch16.0.3.0

oracleretail_integration_busMatch14.1

oracleretail_integration_busMatch15.0

oracleretail_integration_busMatch16.0

oracleretail_predictive_application_serverMatch14.1.3.0

oracleretail_predictive_application_serverMatch15.0

oracleretail_predictive_application_serverMatch15.0.3.0

oracleretail_predictive_application_serverMatch16.0.3.0

oracleretail_service_backboneMatch14.1

oracleretail_service_backboneMatch15.0

oracleretail_service_backboneMatch16.0

oracleretail_store_inventory_managementMatch14.0.4

oracleretail_store_inventory_managementMatch14.1.3

oracleretail_store_inventory_managementMatch15.0.3

oracleretail_store_inventory_managementMatch16.0.3

oracleretail_xstore_point_of_serviceMatch15.0.3

oracleretail_xstore_point_of_serviceMatch16.0.5

oracleretail_xstore_point_of_serviceMatch17.0.3

oracleretail_xstore_point_of_serviceMatch18.0.2

oracleretail_xstore_point_of_serviceMatch19.0.1

oraclestoragetek_acslsMatch8.5.1

oraclestoragetek_tape_analytics_sw_toolMatch2.3

oracleweblogic_serverMatch10.3.6.0.0

oracleweblogic_serverMatch12.1.3.0.0

oracleweblogic_serverMatch12.2.1.3.0

oracleweblogic_serverMatch12.2.1.4.0

oracleweblogic_serverMatch14.1.1.0.0

CPENameOperatorVersion
dell:bsafe_cert-jdell bsafe cert-jle6.2.4
dell:bsafe_crypto-jdell bsafe crypto-jlt6.2.5
dell:bsafe_ssl-jdell bsafe ssl-jle6.2.4.1

CPE	Name	Operator	Version
dell:bsafe_cert-j	dell bsafe cert-j	le	6.2.4
dell:bsafe_crypto-j	dell bsafe crypto-j	lt	6.2.5
dell:bsafe_ssl-j	dell bsafe ssl-j	le	6.2.4.1

CNA Affected

[
  {
    "product": "RSA BSAFE Crypto-J",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "prior to 6.2.5"
      }
    ]
  }
]

References

www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities

www.oracle.com//security-alerts/cpujul2021.html

www.oracle.com/security-alerts/cpuApr2021.html

www.oracle.com/security-alerts/cpuapr2022.html

www.oracle.com/security-alerts/cpujul2020.html

www.oracle.com/security-alerts/cpuoct2020.html

www.oracle.com/security-alerts/cpuoct2021.html

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

7.9 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.5%

JSON

Related for CVE-2019-3740

cvelist1 prion1 nvd1 intothesymmetry1 nessus3 oracle6