CVE-2015-7940

CVSS v2.0 5 (Medium)

EPSS 0.25 % (65^th)

Affected Products 7

Advisories 4

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

Weaknesses

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-310: Cryptographic Issues

CVE Status: PUBLISHED
CNA: MITRE
Published Date: 2015-11-09 16:59:09
(8 years ago)
Updated Date: 2019-01-16 19:29:07
(5 years ago)

Affected Products

Bouncycastle

Bouncy Castle Crypto Package

Opensuse

Oracle

Configuration #1

		CPE23	From	Up To
	Opensuse Leap 42.1	cpe:2.3:o:opensuse:leap:42.1
	Opensuse 13.1	cpe:2.3:o:opensuse:opensuse:13.1
	Opensuse 13.2	cpe:2.3:o:opensuse:opensuse:13.2

Configuration #2

		CPE23	From	Up To
	Bouncycastle Bouncy Castle Crypto Package 1.50 and prior versions	cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package		<= 1.50

Configuration #3

		CPE23	From	Up To
	Oracle Application Testing Suite 12.5.0.1	cpe:2.3:a:oracle:application_testing_suite:12.5.0.1
	Oracle Application Testing Suite 12.5.0.2	cpe:2.3:a:oracle:application_testing_suite:12.5.0.2
	Oracle Application Testing Suite 12.5.0.3	cpe:2.3:a:oracle:application_testing_suite:12.5.0.3
	Oracle Enterprise Manager Ops Center 12.1.4	cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1.4
	Oracle Enterprise Manager Ops Center 12.2.2	cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2
	Oracle Peoplesoft Enterprise Peopletools 8.54	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.54
	Oracle Peoplesoft Enterprise Peopletools 8.55	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55
	Oracle Virtual Desktop Infrastructure 3.5.2	cpe:2.3:a:oracle:virtual_desktop_infrastructure:3.5.2