CVE-2015-7940 Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
MediumCVSS 5.0
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.bouncycastle/bcprov-jdk15(Maven) | < 1.51 | 1.51 |
| org.bouncycastle/bcprov-jdk15(Maven) | = 1.32 | No fix listed |
| org.bouncycastle/bcprov-jdk15(Maven) | = 1.38 | No fix listed |
| org.bouncycastle/bcprov-jdk15(Maven) | = 1.40 | No fix listed |
| org.bouncycastle/bcprov-jdk15(Maven) | = 1.43 | No fix listed |
| org.bouncycastle/bcprov-jdk15(Maven) | = 1.44 | No fix listed |
| org.bouncycastle/bcprov-jdk15(Maven) | = 1.45 | No fix listed |
| org.bouncycastle/bcprov-jdk15(Maven) | = 1.46 | No fix listed |
| org.bouncycastle/bcprov-jdk14(Maven) | < 1.51 | 1.51 |
| org.bouncycastle/bcprov-jdk14(Maven) | = 1.38 | No fix listed |
| org.bouncycastle/bcprov-jdk14(Maven) | = 1.43 | No fix listed |
| org.bouncycastle/bcprov-jdk14(Maven) | = 1.44 | No fix listed |
| org.bouncycastle/bcprov-jdk14(Maven) | = 1.45 | No fix listed |
| org.bouncycastle/bcprov-jdk14(Maven) | = 1.46 | No fix listed |
| org.bouncycastle/bcprov-jdk14(Maven) | = 1.47 | No fix listed |
| org.bouncycastle/bcprov-jdk14(Maven) | = 1.48 | No fix listed |
| org.bouncycastle/bcprov-jdk14(Maven) | = 1.49 | No fix listed |
| org.bouncycastle/bcprov-jdk14(Maven) | = 1.50 | No fix listed |
| org.bouncycastle/bcprov-jdk15on(Maven) | < 1.51 | 1.51 |
| org.bouncycastle/bcprov-jdk15on(Maven) | = 1.46 | No fix listed |
| org.bouncycastle/bcprov-jdk15on(Maven) | = 1.47 | No fix listed |
| org.bouncycastle/bcprov-jdk15on(Maven) | = 1.48 | No fix listed |
| org.bouncycastle/bcprov-jdk15on(Maven) | = 1.49 | No fix listed |
| org.bouncycastle/bcprov-jdk15on(Maven) | = 1.50 | No fix listed |
| debian/bouncycastle(Debian:12) | < 1.51-1 | 1.51-1 |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bouncycastle(Debian:13) | < 1.51-1 | 1.51-1 |
| debian/bouncycastle(Debian:14) | < 1.51-1 | 1.51-1 |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| bouncycastle bouncy castle crypto package | <= 1.50 | No fix listed |
| oracle application testing suite | = 12.5.0.1 | No fix listed |
| oracle application testing suite | = 12.5.0.2 | No fix listed |
| oracle application testing suite | = 12.5.0.3 | No fix listed |
| oracle enterprise manager ops center | = 12.1.4 | No fix listed |
| oracle enterprise manager ops center | = 12.2.2 | No fix listed |
| oracle PeopleSoft Enterprise PeopleTools | = 8.54 | No fix listed |
| oracle PeopleSoft Enterprise PeopleTools | = 8.55 | No fix listed |
| oracle virtual desktop infrastructure | = 3.5.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- USN-3727-1 vendor-advisory
- www.oracle.com
- www.oracle.com
- FEDORA-2015-7d95466eda vendor-advisory
- openSUSE-SU-2015:1911 third-party-advisory vendor-advisory
- RHSA-2016:2035 vendor-advisory
- RHSA-2016:2036 vendor-advisory
- web-in-security.blogspot.ca technical-description
- DSA-3417 vendor-advisory
- [oss-security] 20151022 CVE Request: invalid curve attack on bouncycastle mailing-list third-party-advisory vdb-entry
- [oss-security] 20151022 Re: CVE Request: invalid curve attack on bouncycastle mailing-list third-party-advisory vdb-entry
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com third-party-advisory
- www.oracle.com
- 79091 vdb-entry
- 1037036 vdb-entry
- 1037046 vdb-entry
- 1037053 vdb-entry
- Debian Security Tracker CVE-2015-7940 vendor-advisory
- bugs.debian.org issue-tracking