cbcvebase.
CVE-2015-7940
published 2015-11-09

CVE-2015-7940: The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain…

medium5CVSS 3.1
AVNACLAuNCPINAN
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

Affected

13 ranges
VendorProductVersion rangeFixed in
bouncycastlebouncy_castle_crypto_package<= 1.50
debianbouncycastle< bouncycastle 1.51-1 (bookworm)bouncycastle 1.51-1 (bookworm)
opensuseleap
opensuseopensuse
opensuseopensuse
oracleapplication_testing_suite
oracleapplication_testing_suite
oracleapplication_testing_suite
oracleenterprise_manager_ops_center
oracleenterprise_manager_ops_center
oraclepeoplesoft_enterprise_peopletools
oraclepeoplesoft_enterprise_peopletools
oraclevirtual_desktop_infrastructure

CVSS provenance

nvd5.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM