Observable Discrepancy

2024-04-2515:52:49

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

rsa

handshake

vulnerability

bouncycastle

timing differences

sensitive information

software security

6 Medium

AI Score

Confidence

Low

JSON

Bouncy Castle is vulnerable to Observable Discrepancy. The vulnerability is due to improper handling of exceptions in RSA-based handshakes. An attacker can exploit the timing differences observed during these exceptions to reveal sensitive information.

CPENameOperatorVersion
bouncy castle providerle1.77
bouncy castle providerle1.77
bouncy castle providerle1.77
bouncy castle providerle1.70
bouncy castle tls/jsse apis (fips distribution)le1.0.18
bouncy castle tls/dtls apile1.77
bouncy castle jsse provider and tls/dtls apile1.77
bouncy castle jsse provider and tls/dtls apile1.77
bouncycastlele1.8.9
bouncycastle.cryptographyle2.3.0

Name	Operator	Version
bouncy castle provider	le	1.77
bouncy castle provider	le	1.77
bouncy castle provider	le	1.77
bouncy castle provider	le	1.70
bouncy castle tls/jsse apis (fips distribution)	le	1.0.18
bouncy castle tls/dtls api	le	1.77
bouncy castle jsse provider and tls/dtls api	le	1.77
bouncy castle jsse provider and tls/dtls api	le	1.77
bouncycastle	le	1.8.9
bouncycastle.cryptography	le	2.3.0