Side Channel Leakage

2017-01-1604:04:19

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

71.0%

JSON

bouncycastle is vulnerable to side channel leakages. The library uses large static lookup tables in AESFastEngine mode, meaning where data accessed by the CPU can be observed, it is possible for a malicious user to gain information about the key used to initialize the cipher.

CPENameOperatorVersion
bouncy castle providerle1.46
bouncy castle providerle1.46
bouncy castle providerle1.46
bouncy castle providerle1.46
bouncy castle providereq1.46
bouncy castle providereq1.55
bouncy castle providerle1.55
bouncy castle providerle1.55
bouncy castle providerle1.55
bouncy castle providerle1.55

Name	Operator	Version
bouncy castle provider	le	1.46
bouncy castle provider	le	1.46
bouncy castle provider	le	1.46
bouncy castle provider	le	1.46
bouncy castle provider	eq	1.46
bouncy castle provider	eq	1.55
bouncy castle provider	le	1.55
bouncy castle provider	le	1.55
bouncy castle provider	le	1.55
bouncy castle provider	le	1.55