The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
No history.
Information
Published : 2015-11-09 16:59
Updated : 2024-02-04 18:53
NVD link : CVE-2015-7940
Mitre link : CVE-2015-7940
CVE.ORG link : CVE-2015-7940
JSON object : View
Products Affected
oracle
- application_testing_suite
- peoplesoft_enterprise_peopletools
- virtual_desktop_infrastructure
- enterprise_manager_ops_center
opensuse
- opensuse
- leap
bouncycastle
- bouncy_castle_crypto_package