Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade bouncycastle | Jul 30, 2024 | May 20, 2021 |
| Freebsd | — | Upgrade bouncycastle15Upgrade bouncycastle | Nov 4, 2022 | Aug 20, 2021 |
| Suse | — | Upgrade bouncycastleUpgrade bouncycastle-pgUpgrade bouncycastle-javadocUpgrade bouncycastle-mailUpgrade bouncycastle-tlsUpgrade bouncycastle-pkix | Jul 1, 2021 | May 20, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub