[MAVEN:GHSA-V435-XC8X-WVR9] Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")

Severity Moderate

Affected Packages 13

Fixed Packages 12

CVEs 1

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.

Package	Affected Version
pkg:maven/org.bouncycastle/bctls-jdk18on	< 1.78
pkg:maven/org.bouncycastle/bctls-jdk15to18	< 1.78
pkg:maven/org.bouncycastle/bctls-jdk14	< 1.78
pkg:maven/org.bouncycastle/bctls-fips	< 1.0.19
pkg:maven/org.bouncycastle/bcprov-jdk18on	< 1.78
pkg:maven/org.bouncycastle/bcprov-jdk15to18	< 1.78
pkg:maven/org.bouncycastle/bcprov-jdk15on	< 1.78
pkg:maven/org.bouncycastle/bcprov-jdk14	< 1.78
pkg:maven/org.bouncycastle/bcpkix-jdk18on	< 1.78
pkg:maven/org.bouncycastle/bcpkix-jdk15to18	< 1.78
pkg:maven/org.bouncycastle/bcpkix-jdk14	< 1.78
pkg:maven/BouncyCastle.Cryptography	< 2.3.1
pkg:maven/BouncyCastle	< 2.3.1

Package	Fixed Version
pkg:maven/org.bouncycastle/bctls-jdk18on	= 1.78
pkg:maven/org.bouncycastle/bctls-jdk15to18	= 1.78
pkg:maven/org.bouncycastle/bctls-jdk14	= 1.78
pkg:maven/org.bouncycastle/bctls-fips	= 1.0.19
pkg:maven/org.bouncycastle/bcprov-jdk18on	= 1.78
pkg:maven/org.bouncycastle/bcprov-jdk15to18	= 1.78
pkg:maven/org.bouncycastle/bcprov-jdk15on	= 1.78
pkg:maven/org.bouncycastle/bcprov-jdk14	= 1.78
pkg:maven/org.bouncycastle/bcpkix-jdk18on	= 1.78
pkg:maven/org.bouncycastle/bcpkix-jdk15to18	= 1.78
pkg:maven/org.bouncycastle/bcpkix-jdk14	= 1.78
pkg:maven/BouncyCastle.Cryptography	= 2.3.1

ID

MAVEN:GHSA-V435-XC8X-WVR9

Severity

moderate

URL

https://github.com/advisories/GHSA-v435-xc8x-wvr9

Published

2024-05-14T15:32:54
(2 months ago)

Modified

2024-05-14T20:22:06
(2 months ago)

Rights

Maven Security Team

Other Advisories

SUSE-SU-2024:1539-1

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2024-30171
			https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030171
			https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030171
			https://www.bouncycastle.org/latest_releases.html
			https://github.com/bcgit/bc-csharp/commit/c984b8bfd8544dfc55dba91a02cbbbb9c580c217
			https://github.com/bcgit/bc-java/commit/d7d5e735abd64bf0f413f54fd9e495fc02400fb0
			https://github.com/bcgit/bc-java/commit/e0569dcb1dea9d421d84fc4c5c5688fe101afa2d
			https://github.com/advisories/GHSA-v435-xc8x-wvr9

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.bouncycastle/bctls-jdk18on	org.bouncycastle	bctls-jdk18on	< 1.78
Fixed	pkg:maven/org.bouncycastle/bctls-jdk18on	org.bouncycastle	bctls-jdk18on	= 1.78
Affected	pkg:maven/org.bouncycastle/bctls-jdk15to18	org.bouncycastle	bctls-jdk15to18	< 1.78
Fixed	pkg:maven/org.bouncycastle/bctls-jdk15to18	org.bouncycastle	bctls-jdk15to18	= 1.78
Affected	pkg:maven/org.bouncycastle/bctls-jdk14	org.bouncycastle	bctls-jdk14	< 1.78
Fixed	pkg:maven/org.bouncycastle/bctls-jdk14	org.bouncycastle	bctls-jdk14	= 1.78
Affected	pkg:maven/org.bouncycastle/bctls-fips	org.bouncycastle	bctls-fips	< 1.0.19
Fixed	pkg:maven/org.bouncycastle/bctls-fips	org.bouncycastle	bctls-fips	= 1.0.19
Affected	pkg:maven/org.bouncycastle/bcprov-jdk18on	org.bouncycastle	bcprov-jdk18on	< 1.78
Fixed	pkg:maven/org.bouncycastle/bcprov-jdk18on	org.bouncycastle	bcprov-jdk18on	= 1.78
Affected	pkg:maven/org.bouncycastle/bcprov-jdk15to18	org.bouncycastle	bcprov-jdk15to18	< 1.78
Fixed	pkg:maven/org.bouncycastle/bcprov-jdk15to18	org.bouncycastle	bcprov-jdk15to18	= 1.78
Affected	pkg:maven/org.bouncycastle/bcprov-jdk15on	org.bouncycastle	bcprov-jdk15on	< 1.78
Fixed	pkg:maven/org.bouncycastle/bcprov-jdk15on	org.bouncycastle	bcprov-jdk15on	= 1.78
Affected	pkg:maven/org.bouncycastle/bcprov-jdk14	org.bouncycastle	bcprov-jdk14	< 1.78
Fixed	pkg:maven/org.bouncycastle/bcprov-jdk14	org.bouncycastle	bcprov-jdk14	= 1.78
Affected	pkg:maven/org.bouncycastle/bcpkix-jdk18on	org.bouncycastle	bcpkix-jdk18on	< 1.78
Fixed	pkg:maven/org.bouncycastle/bcpkix-jdk18on	org.bouncycastle	bcpkix-jdk18on	= 1.78
Affected	pkg:maven/org.bouncycastle/bcpkix-jdk15to18	org.bouncycastle	bcpkix-jdk15to18	< 1.78
Fixed	pkg:maven/org.bouncycastle/bcpkix-jdk15to18	org.bouncycastle	bcpkix-jdk15to18	= 1.78
Affected	pkg:maven/org.bouncycastle/bcpkix-jdk14	org.bouncycastle	bcpkix-jdk14	< 1.78
Fixed	pkg:maven/org.bouncycastle/bcpkix-jdk14	org.bouncycastle	bcpkix-jdk14	= 1.78
Affected	pkg:maven/BouncyCastle.Cryptography		BouncyCastle.Cryptography	< 2.3.1
Fixed	pkg:maven/BouncyCastle.Cryptography		BouncyCastle.Cryptography	= 2.3.1
Affected	pkg:maven/BouncyCastle		BouncyCastle	< 2.3.1

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date