Information Diclosure

2017-01-1602:25:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

73.1%

JSON

bouncycastle is vulnerable to timing attacks. Due to the lack of blinding, a malicious user can monitor the time taken to generate a signature to gain information about the signatures k value and eventually the private value.

CPENameOperatorVersion
bouncy castle providerle1.46
bouncy castle providerle1.46
bouncy castle openpgp apile1.46
bouncy castle providerle1.46
bouncy castle providerle1.46
bouncy castle openpgp apile1.46
bouncy castle providereq1.46
bouncy castle openpgp apieq1.46
bouncy castle tsp/mime apieq1.46
bouncy castle providerle1.69

Name	Operator	Version
bouncy castle provider	le	1.46
bouncy castle provider	le	1.46
bouncy castle openpgp api	le	1.46
bouncy castle provider	le	1.46
bouncy castle provider	le	1.46
bouncy castle openpgp api	le	1.46
bouncy castle provider	eq	1.46
bouncy castle openpgp api	eq	1.46
bouncy castle tsp/mime api	eq	1.46
bouncy castle provider	le	1.69