CVE-2019-3739

Description

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.

CVSS breakdown

Affected products

• Dell / bsafe_cert-j6.2.4
• Dell / BSAFE Crypto-J6.2.5
• Dell / BSAFE SSL-J6.2.4.1
• Dell / RSA BSAFE Crypto-Jprior to 6.2.5 – prior to 6.2.5
• oracle / application_performance_management13.3.0.0 – 13.3.0.0
• oracle / application_performance_management13.4.0.0 – 13.4.0.0
• oracle / communications_network_integrity7.3.2 – 7.3.2
• oracle / communications_network_integrity7.3.5 – 7.3.5
• oracle / communications_network_integrity7.3.6 – 7.3.6
• oracle / database12.1.0.2 – 12.1.0.2
• oracle / database12.2.0.1 – 12.2.0.1
• oracle / database18c – 18c
• oracle / database19c – 19c
• oracle / goldengate19.1.0.0.0.210420
• oracle / retail_assortment_planning15.0.3.0 – 15.0.3.0
• oracle / retail_assortment_planning16.0.3.0 – 16.0.3.0
• oracle / retail_integration_bus14.1 – 14.1
• oracle / retail_integration_bus15.0 – 15.0
• oracle / retail_integration_bus16.0 – 16.0
• oracle / retail_predictive_application_server15.0.3.0 – 15.0.3.0
• oracle / retail_predictive_application_server14.1.3.0 – 14.1.3.0
• oracle / retail_predictive_application_server16.0.3.0 – 16.0.3.0
• oracle / retail_service_backbone14.1 – 14.1
• oracle / retail_service_backbone15.0 – 15.0
• oracle / retail_service_backbone16.0 – 16.0
• oracle / retail_store_inventory_management14.0.4 – 14.0.4
• oracle / retail_store_inventory_management14.1.3 – 14.1.3
• oracle / retail_store_inventory_management15.0.3 – 15.0.3
• oracle / retail_store_inventory_management16.0.3 – 16.0.3
• oracle / retail_xstore_point_of_service15.0.3 – 15.0.3
• oracle / retail_xstore_point_of_service16.0.5 – 16.0.5
• oracle / retail_xstore_point_of_service17.0.3 – 17.0.3
• oracle / retail_xstore_point_of_service18.0.2 – 18.0.2
• oracle / retail_xstore_point_of_service19.0.1 – 19.0.1
• oracle / storagetek_acsls8.5.1 – 8.5.1
• oracle / storagetek_tape_analytics_sw_tool2.3 – 2.3
• oracle / weblogic_server10.3.6.0.0 – 10.3.6.0.0
• oracle / weblogic_server12.2.1.3.0 – 12.2.1.3.0
• oracle / weblogic_server12.2.1.4.0 – 12.2.1.4.0
• oracle / weblogic_server14.1.1.0.0 – 14.1.1.0.0

References

• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2020.html
• MISChttps://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html