Vulnerabilities > CVE-2013-1624 - Cryptographic Issues vulnerability in Bouncycastle products

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

bouncycastle

CWE-310

NVD

Published: 2013-02-08

Updated: 2024-11-21

Summary

The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

Vulnerable Configurations

Part	Description	Count
Application	Bouncycastle Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.25 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.40 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.43 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.08 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.20 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.17 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.15 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.42 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.32 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.27 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.41 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.14 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.01 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.30 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.21 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.04 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.07 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.19 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.39 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.23 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.02 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.45 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.09 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.38 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.35 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.05 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.24 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.29 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.12 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.26 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.13 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.33 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.22 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.46 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.16 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.37 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.18 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.28 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.11 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.06 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.31 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.44 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.47 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.10 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.03 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.34 Bouncycastle Legion OF THE Bouncy Castle Java Crytography API 1.36 Bouncycastle Legion OF THE Bouncy Castle C# Cryptography API 0.0 Bouncycastle Legion OF THE Bouncy Castle C# Cryptography API 1.1 Bouncycastle Legion OF THE Bouncy Castle C# Cryptography API 1.2 Bouncycastle Legion OF THE Bouncy Castle C# Cryptography API 1.3 Bouncycastle Legion OF THE Bouncy Castle C# Cryptography API 1.4 Bouncycastle Legion OF THE Bouncy Castle C# Cryptography API 1.7 Bouncycastle Legion OF THE Bouncy Castle C# Cryptography API 1.6.1 Bouncycastle Legion OF THE Bouncy Castle C# Cryptography API 1.0 Bouncycastle Legion OF THE Bouncy Castle C# Cryptography API 1.5	56

Common Weakness Enumeration (CWE)

CWE-310 - Cryptographic Issues

Common Attack Pattern Enumeration and Classification (CAPEC)

Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Redhat

advisories

rhsa
id RHSA-2014:0371
rhsa
id RHSA-2014:0372

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Redhat

References