GHSA-4mv7-cq75-3qjm

Suggest an improvement
Source
https://github.com/advisories/GHSA-4mv7-cq75-3qjm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-4mv7-cq75-3qjm/GHSA-4mv7-cq75-3qjm.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-4mv7-cq75-3qjm
Aliases
Published
2018-10-17T16:27:50Z
Modified
2025-09-12T20:26:05.167976Z
Summary
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Details

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

Database specific 
{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-200"
    ],
    "nvd_published_at": "2015-11-09T16:59:09Z",
    "github_reviewed_at": "2020-06-16T20:58:37Z",
    "github_reviewed": true
}
References

Affected packages

Maven / org.bouncycastle:bcprov-jdk15

Package

Name
org.bouncycastle:bcprov-jdk15
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk15

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.51

Affected versions

1.*

1.32
1.38
1.40
1.43
1.44
1.45
1.46

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-4mv7-cq75-3qjm/GHSA-4mv7-cq75-3qjm.json"

Maven / org.bouncycastle:bcprov-jdk14

Package

Name
org.bouncycastle:bcprov-jdk14
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk14

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.51

Affected versions

1.*

1.38
1.43
1.44
1.45
1.46
1.47
1.48
1.49
1.50

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-4mv7-cq75-3qjm/GHSA-4mv7-cq75-3qjm.json"

Maven / org.bouncycastle:bcprov-jdk15on

Package

Name
org.bouncycastle:bcprov-jdk15on
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk15on

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.51

Affected versions

1.*

1.46
1.47
1.48
1.49
1.50

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-4mv7-cq75-3qjm/GHSA-4mv7-cq75-3qjm.json"