CVE-2019-3740

Опубликовано: 18 сент. 2019

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.

Ссылки

https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities
https://www.oracle.com//security-alerts/cpujul2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities
https://www.oracle.com//security-alerts/cpujul2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:dell:bsafe_cert-j:*:*:*:*:*:*:*:*

Версия до 6.2.4 (включая)

cpe:2.3:a:dell:bsafe_crypto-j:*:*:*:*:*:*:*:*

Версия до 6.2.5 (исключая)

cpe:2.3:a:dell:bsafe_ssl-j:*:*:*:*:*:*:*:*

Версия до 6.2.4.1 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:oracle:application_performance_management:13.3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_performance_management:13.4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_network_integrity:7.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_network_integrity:7.3.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:database:12.1.0.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:database:18c:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:database:19c:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*

Версия до 12.2.0.1.22 (исключая)

cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*

Версия до 19.1.0.0.0.210420 (исключая)

cpe:2.3:a:oracle:retail_assortment_planning:15.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_assortment_planning:16.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01239

Низкий

6.5 Medium

CVSS3

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-310

CWE-203

Связанные уязвимости

GHSA-7mmw-x6rm-hmr8

CVSS3: 6.5

github

больше 3 лет назад

BDU:2020-04988

CVSS3: 6.5

fstec

больше 5 лет назад

Уязвимость компонента Comp Management and Life Cycle Management (RSA BSAFE Crypto-J) программного обеспечения мониторинга Oracle Application Performance Management программной платформы Oracle Enterprise Manager, позволяющая нарушителю получить несанкционированный доступ к информации

EPSS

Процентиль: 79%

0.01239

Низкий

6.5 Medium

CVSS3

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-310

CWE-203