PT-2020-6924 · Bouncy Castle+1 · Bouncy Castle Bc-Fja+3

Published 2020-07-04 · Updated 2025-10-02 · CVE-2020-15522

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle BC Java versions 1.65 and earlier Bouncy Castle BC C# .NET versions 1.8.6 and earlier Bouncy Castle BC-FJA versions 1.0.2.0 and earlier Bouncy Castle BC-FNA versions 1.0.1.0 and earlier

Description The issue is related to a timing problem within the EC math library of Bouncy Castle, which can expose information about the private key when an attacker observes timing information for the generation of multiple deterministic ECDSA signatures. This is due to synchronization errors when using a shared resource during the processing of deterministic ECDSA signatures.

Recommendations For Bouncy Castle BC Java versions 1.65 and earlier, update to version 1.66 or later. For Bouncy Castle BC C# .NET versions 1.8.6 and earlier, update to version 1.8.7 or later. For Bouncy Castle BC-FJA versions 1.0.2.0 and earlier, update to version 1.0.2.1 or later. For Bouncy Castle BC-FNA versions 1.0.1.0 and earlier, update to version 1.0.1.1 or later.

Exploit

Fix

Race Condition

Side Channel Attack

Weakness Enumeration

CWE-362

CWE-203

Related Identifiers

BDU:2023-07367

CVE-2020-15522

GHSA-6XX3-RG99-GC3P

OESA-2021-1301

OPENSUSE-SU-2021:0940-1

OPENSUSE-SU-2021:2163-1

OPENSUSE-SU-2021_0940-1

OPENSUSE-SU-2021_2163-1

OPENSUSE-SU-2024:10661-1

OPENSUSE-SU-2024:12868-1

SUSE-SU-2021:2163-1

SUSE-SU-2021_2163-1

Affected Products

Bouncy Castle Bc C# .Net

Bouncy Castle Bc Java

Bouncy Castle Bc-Fja

Suse

References · 46

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE-2020-15522 · Exploit
• 🔥 https://github.com/bcgit/bc-csharp/wiki/CVE-2020-15522 · Exploit
• https://bouncycastle.org/releasenotes.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:2163-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15522 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15522 · Security Note
• https://osv.dev/vulnerability/GHSA-6xx3-rg99-gc3p · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0940-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15522 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1301 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07367 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-15522 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-15522 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15522 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15522 · Vendor Advisory