Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack in the ML-KEM Poly.toMsg, Poly.compressPoly, and PolyVec.compressPolyVec routines. An attacker can recover a long-term private key by sending ciphertexts and measuring the time taken by repeated decapsulation operations th...

cn.jarkata:jarkata-encrypt (1.0.0), com.amazonaws:aws-encryption-sdk-java (>=2.4.1, <=3.0.0) +237 more potentially affected by CVE-2024-14041 via org.bouncycastle:bcprov-ext-jdk18on (>=1.73, <=1.77)

org.bouncycastle:bcprov-ext-jdk18on MAVEN version =1.73, =2.4.1, =3.0.0 - com.clever-cloud.pulsar4s:pulsar4s-akka-streams2.12 2.9.1 - com.clever-cloud.pulsar4s:pulsar4s-akka-streams2.13 2.9.1 - com.clever-cloud.pulsar4s:pulsar4s-akka-streams3 2.9.1 - com.clever-cloud.pulsar4s:pulsar4s-avro2.12...

fr.xelians:datahub-studio (>=2.0.0, <=3.0.0), io.github.vantiv:cnp-sdk-for-java (>=12.31.0, <=12.34.0) +28 more potentially affected by CVE-2024-14041 via org.bouncycastle:bcprov-ext-jdk15to18 (>=1.75, <=1.76)

org.bouncycastle:bcprov-ext-jdk15to18 MAVEN version =1.75, =2.0.0, =12.31.0, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.7 and more Source cves: CVE-2024-14041 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18390231...

org.apache.camel.quarkus:camel-quarkus-as2 (>=3.0.0-rc1, <=3.10.0), org.apache.camel.quarkus:camel-quarkus-as2-deployment (>=3.0.0-rc1, <=3.10.0) +4 more potentially affected by CVE-2024-14041 via org.bouncycastle:bcprov-debug-jdk18on (>=1.74, <=1.77)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.74, =3.0.0-rc1, =3.0.0-rc1, =3.2.0, =3.20.7, =3.20.7, =3.20.7, =4.5.0 Source cves: CVE-2024-14041 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18390229...

CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

app.cash.lilbitcoinj:lilbitcoinj-core (>=0.0.2, <=0.0.3), app.cash.lninvoice:ln-invoice (>=0.0.2.1, <=0.0.6) +696 more potentially affected by CVE-2024-14041 via org.bouncycastle:bcprov-jdk15to18 (>=1.73, <=1.77)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.73, =0.0.2, =0.0.2.1, =1.0.1-rc14, =2.1.0, =1.2.2, =0.9.1, =0.0.1, =3.1.2, =10.1.2, =0.0.27, =0.0.56, =1.5.2, =1.0.4, =1.8.9 and more Source cves: CVE-2024-14041 Source advisory: MEND:CVE-2024-14041...

fr.xelians:datahub-studio (>=2.0.0, <=3.0.0), io.github.vantiv:cnp-sdk-for-java (>=12.31.0, <=12.34.0) +28 more potentially affected by CVE-2024-14041 via org.bouncycastle:bcprov-ext-jdk15to18 (>=1.75, <=1.76)

org.bouncycastle:bcprov-ext-jdk15to18 MAVEN version =1.75, =2.0.0, =12.31.0, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.6, =v9.6.7 and more Source cves: CVE-2024-14041 Source advisory: MEND:CVE-2024-14041...

cn.jarkata:jarkata-encrypt (1.0.0), com.amazonaws:aws-encryption-sdk-java (>=2.4.1, <=3.0.0) +237 more potentially affected by CVE-2024-14041 via org.bouncycastle:bcprov-ext-jdk18on (>=1.73, <=1.77)

org.bouncycastle:bcprov-ext-jdk18on MAVEN version =1.73, =2.4.1, =3.0.0 - com.clever-cloud.pulsar4s:pulsar4s-akka-streams2.12 2.9.1 - com.clever-cloud.pulsar4s:pulsar4s-akka-streams2.13 2.9.1 - com.clever-cloud.pulsar4s:pulsar4s-akka-streams3 2.9.1 - com.clever-cloud.pulsar4s:pulsar4s-avro2.12...