PT-2009-1169 · Bouncy Castle · Bouncy Castle Java Cryptography Api+1

Published 2009-03-30 · Updated 2025-05-12 · CVE-2007-6721

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bouncy Castle Java Cryptography API versions prior to 1.38 Crypto Provider Package versions prior to 1.36

Description The issue is related to a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes, which has unknown impact and remote attack vectors.

Recommendations For Bouncy Castle Java Cryptography API versions prior to 1.38, update to version 1.38 or later. For Crypto Provider Package versions prior to 1.36, update to version 1.36 or later.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2007-6721

GHSA-M26P-M559-G5J5

Affected Products

Bouncy Castle Java Cryptography Api

Crypto Provider Package

References · 16

• https://osv.dev/vulnerability/GHSA-m26p-m559-g5j5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6721 · Security Note
• http://bouncycastle.org/devmailarchive/msg08195.html · Vendor Advisory
• http://bouncycastle.org/csharp · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-6721 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6721 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6721 · Vendor Advisory
• https://github.com/bcgit/bc-java · Note
• http://osvdb.org/50360 · Note
• https://t.me/cvenotify/121774 · Telegram Post
• https://web.archive.org/web/20071022023551/http://bouncycastle.org/csharp · Note
• http://osvdb.org/50358 · Note
• https://web.archive.org/web/20080316202318/http://bouncycastle.org:80/releasenotes.html · Note
• http://osvdb.org/50359 · Note
• http://freshmeat.net/projects/bouncycastlecryptoapi/releases/265580 · Note