Описание
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
It was found that bouncycastle is vulnerable to an invalid curve attack. An attacker could extract private keys used in elliptic curve cryptography with a few thousand queries.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss A-MQ 6 | fabric8 | Affected | ||
| Red Hat JBoss Fuse 6 | fabric8 | Affected | ||
| Red Hat Satellite 6 | bouncycastle | Will not fix | ||
| Red Hat Subscription Asset Manager | bouncycastle | Will not fix | ||
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2016:2036 | 06.10.2016 | |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2016:2035 | 06.10.2016 |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
4.3 Medium
CVSS2
Связанные уязвимости
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
The Bouncy Castle Java library before 1.51 does not validate a point i ...
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
EPSS
3.7 Low
CVSS3
4.3 Medium
CVSS2