~ / search / GHSA-m26p-m559-g5j5

GHSA-m26p-m559-g5j5

Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2007-6721

Packages

EcosystemPackageAffectedFixed in
Maven bouncycastle:bcprov-jdk14 < 1.38 1.38
Maven bouncycastle:bcprov-jdk15 < 1.38 1.38
Maven bouncycastle:bcprov-jdk16 < 1.38 1.38

Details

As written in the advisory (Markdown source, shown as plain text).

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."

References

External links from the advisory. They lead to third-party sites.