Lack of data validation In org.bouncycastle:bcprov-jdk15on
Description
Improper Input Validation in Bouncy Castle The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 1.48 | ||
 debian 13 | 1.48+dfsg-2 | ||
debian 12 | 1.48+dfsg-2 | ||
debian 14 | 1.48+dfsg-2 | ||
debian 11 | 1.48+dfsg-2 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4.