CVE-2019-3740
published 2019-09-18CVE-2019-3740: RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A…
PriorityP433medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
3.75%
88.7th percentile
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
Affected
48 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dell | bsafe_cert-j | <= 6.2.4 | — |
| dell | bsafe_crypto-j | < 6.2.5 | 6.2.5 |
| dell | bsafe_ssl-j | <= 6.2.4.1 | — |
| dell | rsa_bsafe_crypto-j | — | — |
| oracle | application_performance_management | — | — |
| oracle | application_performance_management | — | — |
| oracle | communications_network_integrity | — | — |
| oracle | communications_network_integrity | — | — |
| oracle | communications_network_integrity | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | communications_unified_inventory_management | — | — |
| oracle | database | — | — |
| oracle | database | — | — |
| oracle | database | — | — |
| oracle | database | — | — |
| oracle | global_lifecycle_management_opatch | < 12.2.0.1.22 | 12.2.0.1.22 |
| oracle | goldengate | < 19.1.0.0.0.210420 | 19.1.0.0.0.210420 |
| oracle | retail_assortment_planning | — | — |
| oracle | retail_assortment_planning | — | — |
| oracle | retail_integration_bus | — | — |
| oracle | retail_integration_bus | — | — |
| oracle | retail_integration_bus | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_oracle6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Applications Risk Matrix: Installer (RSA BSAFE Crypto-J) — CVE-2019-3740
vendor_oracle·2022-04-15·CVSS 6.5
CVE-2019-3740 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: Installer (RSA BSAFE Crypto-J) — CVE-2019-3740
Oracle Oracle Communications Applications Risk Matrix: Installer (RSA BSAFE Crypto-J) vulnerability
CVE: CVE-2019-3740
CVSS: 6.5
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Oracle
Oracle Oracle GoldenGate Risk Matrix: Install (Dell BSAFE Crypto-J) — CVE-2019-3740
vendor_oracle·2021-10-15·CVSS 6.5
CVE-2019-3740 [MEDIUM] Oracle Oracle GoldenGate Risk Matrix: Install (Dell BSAFE Crypto-J) — CVE-2019-3740
Oracle Oracle GoldenGate Risk Matrix: Install (Dell BSAFE Crypto-J) vulnerability
CVE: CVE-2019-3740
CVSS: 6.5
Protocol: Oracle Net
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2021 (OCT 2021)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Inventory Organizer (BSAFE Crypto-J) — CVE-2019-3740
vendor_oracle·2021-07-15·CVSS 6.5
CVE-2019-3740 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: Inventory Organizer (BSAFE Crypto-J) — CVE-2019-3740
Oracle Oracle Communications Applications Risk Matrix: Inventory Organizer (BSAFE Crypto-J) vulnerability
CVE: CVE-2019-3740
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) — CVE-2019-3740
vendor_oracle·2021-04-15·CVSS 6.5
CVE-2019-3740 [MEDIUM] Oracle Oracle Database Server Risk Matrix: Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) — CVE-2019-3740
Oracle Oracle Database Server Risk Matrix: Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) vulnerability
CVE: CVE-2019-3740
CVSS: 6.5
Protocol: Oracle Net
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Comp Management and Life Cycle Management (RSA BSAFE Crypto-J) — CVE-2019-3740
vendor_oracle·2020-10-15·CVSS 6.5
CVE-2019-3740 [MEDIUM] Oracle Oracle Enterprise Manager Risk Matrix: Comp Management and Life Cycle Management (RSA BSAFE Crypto-J) — CVE-2019-3740
Oracle Oracle Enterprise Manager Risk Matrix: Comp Management and Life Cycle Management (RSA BSAFE Crypto-J) vulnerability
CVE: CVE-2019-3740
CVSS: 6.5
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Oracle
Oracle Oracle Retail Applications Risk Matrix: SIM Integration (BSAFE Crypto-J) — CVE-2019-3740
vendor_oracle·2020-07-15·CVSS 6.5
CVE-2019-3740 [MEDIUM] Oracle Oracle Retail Applications Risk Matrix: SIM Integration (BSAFE Crypto-J) — CVE-2019-3740
Oracle Oracle Retail Applications Risk Matrix: SIM Integration (BSAFE Crypto-J) vulnerability
CVE: CVE-2019-3740
CVSS: 6.5
Protocol: TLS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2020 (JUL 2020)
GHSA
GHSA-7mmw-x6rm-hmr8: RSA BSAFE Crypto-J versions prior to 6
ghsa_unreviewed·2022-05-24
CVE-2019-3740 [MEDIUM] CWE-200 GHSA-7mmw-x6rm-hmr8: RSA BSAFE Crypto-J versions prior to 6
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE®%3B-Crypto-J-Multiple-Security-Vulnerabilitieshttps://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE®%3B-Crypto-J-Multiple-Security-Vulnerabilitieshttps://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2019-09-18
Published