CVE-2019-3738
Medium
Description
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Dell Bsafe Cert-j
PublishedSep 18, 2019
First seenSep 18, 2019
Weakness typeCWE-325CWE-325
How to fix
Update
- dell bsafe_crypto-j6.2.5 or later
- oracle goldengate19.1.0.0.0.210420 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell bsafe_cert-j | v ≤ 6.2.4 | — |
| dell bsafe_crypto-j | v < 6.2.5 | 6.2.5 |
| dell bsafe_ssl-j | v ≤ 6.2.4.1 | — |
| mcafee threat_intelligence_exchange_server | 2.0.0 ≤ v ≤ 2.3.1, 3.0.0 | — |
| oracle application_performance_management | 13.3.0.0, 13.4.0.0 | — |
| oracle communications_network_integrity | 7.3.2, 7.3.5, 7.3.6 | — |
| oracle communications_unified_inventory_management | 7.3.2, 7.3.4, 7.3.5, 7.4.0, 7.4.1 | — |
| oracle database | 12.1.0.2, 12.2.0.1, 18c, 19c | — |
| oracle goldengate | v < 19.1.0.0.0.210420, 19.1.0.0.0.210420 | 19.1.0.0.0.210420 |
| oracle retail_assortment_planning | 15.0.3.0, 16.0.3.0 | — |
| oracle retail_integration_bus | 14.1, 15.0, 16.0 | — |
| oracle retail_predictive_application_server | 14.1.3.0, 15.0.3.0, 16.0.3.0 | — |
| oracle retail_service_backbone | 14.1, 15.0, 16.0 | — |
| oracle retail_store_inventory_management | 14.0.4, 14.1.3, 15.0.3, 16.0.3 | — |
| oracle retail_xstore_point_of_service | 15.0.3, 16.0.5, 17.0.3, 18.0.2, 19.0.1 | — |
| oracle storagetek_tape_analytics_sw_tool | 2.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.