Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZ4eDMtcmc5OS1nYzNw

Timing based private key exposure in Bouncy Castle

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.2.1, BC before 1.66, BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

Permalink: https://github.com/advisories/GHSA-6xx3-rg99-gc3p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZ4eDMtcmc5OS1nYzNw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: over 1 year ago

CVSS Score: 5.1
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00128
EPSS Percentile: 0.4796

Identifiers: GHSA-6xx3-rg99-gc3p, CVE-2020-15522
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-15522
• https://github.com/bcgit/bc-csharp/wiki/CVE-2020-15522
• https://github.com/bcgit/bc-java/wiki/CVE-2020-15522
• https://security.netapp.com/advisory/ntap-20210622-0007/
• https://www.bouncycastle.org/releasenotes.html
• https://github.com/advisories/GHSA-6xx3-rg99-gc3p

Repository: https://github.com/bcgit/bc-csharp
Blast Radius: 22.8

Affected Packages