Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

2018-10-1716:27:50

Google

osv.dev

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

63.9%

JSON

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an “invalid curve attack.”

CPENameOperatorVersion
org.bouncycastle:bcprov-jdk15eq1.38
org.bouncycastle:bcprov-jdk14eq1.45
org.bouncycastle:bcprov-jdk15eq1.43
org.bouncycastle:bcprov-jdk14eq1.47
org.bouncycastle:bcprov-jdk14eq1.48
org.bouncycastle:bcprov-jdk15eq1.44
org.bouncycastle:bcprov-jdk15eq1.40
org.bouncycastle:bcprov-jdk14eq1.38
org.bouncycastle:bcprov-jdk14eq1.43
org.bouncycastle:bcprov-jdk14eq1.49

Name	Operator	Version
org.bouncycastle:bcprov-jdk15	eq	1.38
org.bouncycastle:bcprov-jdk14	eq	1.45
org.bouncycastle:bcprov-jdk15	eq	1.43
org.bouncycastle:bcprov-jdk14	eq	1.47
org.bouncycastle:bcprov-jdk14	eq	1.48
org.bouncycastle:bcprov-jdk15	eq	1.44
org.bouncycastle:bcprov-jdk15	eq	1.40
org.bouncycastle:bcprov-jdk14	eq	1.38
org.bouncycastle:bcprov-jdk14	eq	1.43
org.bouncycastle:bcprov-jdk14	eq	1.49