CVE-2020-15522
Medium
Description
Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
SeverityMedium
CVSS5.9
Exploit probability—
ProductBouncycastle Bouncy Castle Fips .net Api
PublishedMay 20, 2021
First seenMay 20, 2021
How to fix
Update
- bouncycastle bouncy_castle_fips_.net_api1.0.1.1 or later
- bouncycastle bc-csharp1.8.7 or later
- bouncycastle fips_java_api1.0.1.2, 1.0.2.1 or later
- bouncycastle the_bouncy_castle_crypto_package_for_java1.66 or later
- org.bouncycastle:bc-fips1.0.2.1 or later
- org.bouncycastle:bcprov-ext-jdk15on1.66 or later
- org.bouncycastle:bcprov-ext-jdk161.66 or later
- org.bouncycastle:bcprov-jdk141.66 or later
- org.bouncycastle:bcprov-jdk151.66 or later
- org.bouncycastle:bcprov-jdk15on1.66 or later
- org.bouncycastle:bcprov-jdk15to181.66 or later
- org.bouncycastle:bcprov-jdk161.66 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bouncycastle bouncy_castle_fips_.net_api | v < 1.0.1.1 | 1.0.1.1 |
| bouncycastle bc-csharp | v < 1.8.7 | 1.8.7 |
| bouncycastle fips_java_api | v < 1.0.1.2, 1.0.2 ≤ v < 1.0.2.1 | 1.0.1.2, 1.0.2.1 |
| bouncycastle the_bouncy_castle_crypto_package_for_java | v < 1.66 | 1.66 |
| org.bouncycastle:bc-fipsMaven | v < 1.0.2.1 | 1.0.2.1 |
| org.bouncycastle:bcprov-ext-jdk15onMaven | v < 1.66 | 1.66 |
| org.bouncycastle:bcprov-ext-jdk16Maven | v < 1.66 | 1.66 |
| org.bouncycastle:bcprov-jdk14Maven | v < 1.66 | 1.66 |
| org.bouncycastle:bcprov-jdk15Maven | v < 1.66 | 1.66 |
| org.bouncycastle:bcprov-jdk15onMaven | v < 1.66 | 1.66 |
| org.bouncycastle:bcprov-jdk15to18Maven | v < 1.66 | 1.66 |
| org.bouncycastle:bcprov-jdk16Maven | v < 1.66 | 1.66 |
| BouncyCastleNuGet | v < 1.8.7 | 1.8.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.