PT-2015-2750 · Bouncy Castle+3 · Bouncy Castle Java Library+4

Publicado 2015-11-04 · Atualizado 2024-06-15 · CVE-2015-7940

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle Java library versions prior to 1.51 openSUSE (affected versions not specified)

Description The issue is related to an "invalid curve attack" where remote attackers can obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges due to the lack of validation of a point within the elliptic curve. This can be exploited by making changes to the elliptic curve Diffie-Hellman algorithm, allowing an attacker to gain access to the private key.

Recommendations For Bouncy Castle Java library versions prior to 1.51, update to version 1.51 or later to resolve the issue. For openSUSE, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-310

Identificadores relacionados

BDU:2015-12115

CVE-2015-7940

DLA-361-1

DSA-3417-1

GHSA-4MV7-CQ75-3QJM

MGASA-2015-0487

OPENSUSE-SU-2015_1911-1

OPENSUSE-SU-2024:10486-1

USN-3727-1

Produtos afetados

Bouncy Castle Java Library

Jira

Suse

Ubuntu

Opensuse

Referências · 67

• https://ubuntu.com/security/CVE-2016-1000338 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-7575 · Nota
• https://ubuntu.com/security/CVE-2016-1000339 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-2035.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6644 · Nota de Segurança
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00036.html · Nota
• https://ubuntu.com/security/CVE-2016-1000342 · Aviso do Fabricante
• http://debian.org/security/2015/dsa-3417 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Nota
• https://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html · Nota
• https://suse.com/security/cve/CVE-2015-7940.html · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174915.html · Aviso do Fabricante
• https://github.com/advisories/GHSA-4mv7-cq75-3qjm · Nota
• https://bdu.fstec.ru/vul/2016-00077 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000345 · Nota de Segurança