CVE-2019-3739
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
- Score
- CVSS 3.1 6.5 Medium
- Status
- Modified - security_alert@emc.com
- Published
- 2019-09-18
- Last modified
- 2026-10-08
- Weaknesses
- CWE-203, CWE-310
Affected products
- Bsafe Cert-j (Dell)
- Bsafe Crypto-j (Dell)
- Bsafe Ssl-j (Dell)
- Rsa Bsafe Crypto-j (Dell)
- Application Performance Management (Oracle)
- Communications Network Integrity (Oracle)
- Database (Oracle)
- Goldengate (Oracle)
- Retail Assortment Planning (Oracle)
- Retail Integration Bus (Oracle)
- Retail Predictive Application Server (Oracle)
- Retail Service Backbone (Oracle)
- Retail Store Inventory Management (Oracle)
- Retail Xstore Point Of Service (Oracle)
- Storagetek Acsls (Oracle)
- Storagetek Tape Analytics Sw Tool (Oracle)
- Weblogic Server (Oracle)
References
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE®%3B-Crypto-J-Multiple-Securit…
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
