Описание
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.
A flaw was found in the Bouncy Castle Java cryptography APIs. Affected versions of the org.bouncycastle:bcprov-jdk18on package are vulnerable to Observable Timing Discrepancy via the PKCS#1 1.5 and OAEP decryption process (a.k.a. Marvin Attack). An attacker can recover cipher-texts via a side-channel attack by exploiting the Marvin security flaw. The PKCS#1 1.5 attack vector leaks data via javax.crypto.Cipher exceptions and the OAEP interface vector leaks via the bit size of the decrypted data.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 2 | org.bouncycastle-bcprov-jdk18on | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | org.bouncycastle-bcprov-jdk18on | Affected | ||
| Red Hat build of Apache Camel for Spring Boot 3 | org.bouncycastle-bcprov-jdk18on | Out of support scope | ||
| Red Hat Build of Keycloak | org.bouncycastle-bcprov-jdk18on | Affected | ||
| Red Hat build of Quarkus | bcprov-jdk18on | Not affected | ||
| Red Hat build of Quarkus | bcprov-jdk18on | Not affected | ||
| Red Hat Data Grid 8 | org.bouncycastle-bcprov-jdk18on | Not affected | ||
| Red Hat Fuse 7 | org.bouncycastle-bcprov-jdk18on | Affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | org.bouncycastle-bcprov-jdk18on | Not affected | ||
| streams for Apache Kafka | org.bouncycastle-bcprov-jdk18on | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provide ...
EPSS
5.9 Medium
CVSS3