Filtered by vendor Bouncycastle
Subscribe
Total
25 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-1000352 | 1 Bouncycastle | 1 Legion-of-the-bouncy-castle-java-crytography-api | 2023-12-10 | 5.8 MEDIUM | 7.4 HIGH |
| In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider. | |||||
| CVE-2017-13098 | 1 Bouncycastle | 1 Legion-of-the-bouncy-castle-java-crytography-api | 2023-12-10 | 4.3 MEDIUM | 5.9 MEDIUM |
| BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT." | |||||
| CVE-2015-7940 | 3 Bouncycastle, Opensuse, Oracle | 7 Bouncy Castle Crypto Package, Leap, Opensuse and 4 more | 2023-12-10 | 5.0 MEDIUM | N/A |
| The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack." | |||||
| CVE-2013-1624 | 1 Bouncycastle | 2 Legion-of-the-bouncy-castle-c\#-cryptography-api, Legion-of-the-bouncy-castle-java-crytography-api | 2023-12-10 | 4.0 MEDIUM | N/A |
| The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. | |||||
| CVE-2007-6721 | 1 Bouncycastle | 2 Bouncy-castle-crypto-package, Legion-of-the-bouncy-castle-java-crytography-api | 2023-12-10 | 10.0 HIGH | N/A |
| The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes." | |||||