Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRtdjctY3E3NS0zcWpt

Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

Permalink: https://github.com/advisories/GHSA-4mv7-cq75-3qjm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRtdjctY3E3NS0zcWpt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 6 years ago
Updated: almost 2 years ago


EPSS Percentage: 0.00246
EPSS Percentile: 0.64883

Identifiers: GHSA-4mv7-cq75-3qjm, CVE-2015-7940
References: Blast Radius: 0.0

Affected Packages

maven:org.bouncycastle:bcprov-jdk14
Dependent packages: 33
Dependent repositories: 201
Downloads:
Affected Version Ranges: < 1.51
Fixed in: 1.51
All affected versions:
All unaffected versions: 1.78.1
maven:org.bouncycastle:bcprov-jdk15
Dependent packages: 104
Dependent repositories: 985
Downloads:
Affected Version Ranges: < 1.51
Fixed in: 1.51
All affected versions:
All unaffected versions: