Описание
Security update for bouncycastle
bouncycastle was updated to version 1.53 to fix one security issue.
This security issue was fixed:
- CVE-2015-7940: Invalid curve attack (bsc#951727).
Список пакетов
openSUSE Leap 42.1
bouncycastle-1.53-16.1
bouncycastle-javadoc-1.53-16.1
Ссылки
- E-Mail link for openSUSE-SU-2015:1911-1
- SUSE Security Ratings
Описание
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Затронутые продукты
openSUSE Leap 42.1:bouncycastle-1.53-16.1
openSUSE Leap 42.1:bouncycastle-javadoc-1.53-16.1
Ссылки
- CVE-2015-7940
- SUSE Bug 951727