GHSA-72m5-fvvv-55m6

Suggest an improvement
Source
https://github.com/advisories/GHSA-72m5-fvvv-55m6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-72m5-fvvv-55m6/GHSA-72m5-fvvv-55m6.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-72m5-fvvv-55m6
Aliases
Published
2021-04-22T16:16:49Z
Modified
2024-03-14T22:15:56.247208Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Observable Differences in Behavior to Error Inputs in Bouncy Castle
Details

In Legion of the Bouncy Castle BC before 1.55 and BC-FJA before 1.0.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.

Database specific 
{
    "nvd_published_at": "2020-11-02T22:15:00Z",
    "cwe_ids": [
        "CWE-203"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-20T16:59:30Z"
}
References

Affected packages

Maven / org.bouncycastle:bcprov-jdk14

Package

Name
org.bouncycastle:bcprov-jdk14
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk14

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.61

Affected versions

1.*

1.38
1.43
1.44
1.45
1.46
1.47
1.48
1.49
1.50
1.51
1.53
1.54
1.55
1.56
1.57
1.58
1.59
1.60

Maven / org.bouncycastle:bcprov-jdk15

Package

Name
org.bouncycastle:bcprov-jdk15
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk15

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.61

Affected versions

1.*

1.32
1.38
1.40
1.43
1.44
1.45
1.46

Maven / org.bouncycastle:bcprov-jdk16

Package

Name
org.bouncycastle:bcprov-jdk16
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk16

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.61

Affected versions

1.*

1.38
1.40
1.43
1.44
1.45
1.46

Maven / org.bouncycastle:bc-fips

Package

Name
org.bouncycastle:bc-fips
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bc-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.2

Affected versions

1.*

1.0.0
1.0.1

Maven / org.bouncycastle:bcprov-ext-jdk15on

Package

Name
org.bouncycastle:bcprov-ext-jdk15on
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-ext-jdk15on

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.61

Affected versions

1.*

1.46
1.47
1.48
1.49
1.50
1.51
1.52
1.53
1.54
1.55
1.56
1.57
1.58
1.59
1.60

Maven / org.bouncycastle:bcprov-ext-jdk16

Package

Name
org.bouncycastle:bcprov-ext-jdk16
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-ext-jdk16

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.61

Affected versions

1.*

1.45
1.46

Maven / org.bouncycastle:bcprov-jdk15on

Package

Name
org.bouncycastle:bcprov-jdk15on
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk15on

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.61

Affected versions

1.*

1.46
1.47
1.48
1.49
1.50
1.51
1.52
1.53
1.54
1.55
1.56
1.57
1.58
1.59
1.60

Maven / org.bouncycastle:bcprov-jdk15to18

Package

Name
org.bouncycastle:bcprov-jdk15to18
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk15to18

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.61