Partial Key Validation

2017-01-1309:33:49

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

71.0%

JSON

bouncycastle is vulnerable to partial key validation. The library doesn’t fully validate the other parties’ Diffie-Hellman key, meaning that invalid keys can reveal information about the other parties’ private key when static Diffie-Hellman is used.

CPENameOperatorVersion
bouncy castle providerle1.46
bouncy castle providerle1.46
bouncy castle providerle1.46
bouncy castle providerle1.46
bouncy castle providereq1.46
bouncy castle providerle1.54
bouncy castle providerle1.55
bouncy castle providerle1.55
bouncy castle providerle1.55
bouncy castle providerle1.69

Name	Operator	Version
bouncy castle provider	le	1.46
bouncy castle provider	le	1.46
bouncy castle provider	le	1.46
bouncy castle provider	le	1.46
bouncy castle provider	eq	1.46
bouncy castle provider	le	1.54
bouncy castle provider	le	1.55
bouncy castle provider	le	1.55
bouncy castle provider	le	1.55
bouncy castle provider	le	1.69