|
Vulnerabilities
< Back

CVE-2020-15522

Updated on 20 May 2021

Severity

5.9 Medium severity

Details

CVSS score
5.9
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

Details

Affected product:
Apache Hadoop , Apache Hive , Bouncy Castle , Eclipse Jetty , Hibernate , OkHttp , Spring , cocoon , directory-server , druid , gradle , itextpdf , java-opensaml , jets3t , jgit , logging-log4j2 , lucene , netty , opensaml-security-api , solr , wildfly , ws-wss4j
Affected packages:
cocoon-xsp-impl @ 2.3.0 (+1537 more)
Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

Fixes