GHSA-9gp4-qrff-c648

Suggest an improvement
Source
https://github.com/advisories/GHSA-9gp4-qrff-c648
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-9gp4-qrff-c648/GHSA-9gp4-qrff-c648.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-9gp4-qrff-c648
Aliases
Published
2018-10-18T18:04:13Z
Modified
2024-12-02T05:28:39.566208Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.

Database specific
{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:28:32Z"
}
References

Affected packages

Maven / org.bouncycastle:bcprov-jdk14

Package

Name
org.bouncycastle:bcprov-jdk14
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk14

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.56

Affected versions

1.*

1.38
1.43
1.44
1.45
1.46
1.47
1.48
1.49
1.50
1.51
1.53
1.54
1.55

Maven / org.bouncycastle:bcprov-jdk15

Package

Name
org.bouncycastle:bcprov-jdk15
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk15

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.56

Affected versions

1.*

1.32
1.38
1.40
1.43
1.44
1.45
1.46