CVE-2007-6721: Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability in bouncycastle:bcprov-jdk14
Summary
CVE-2007-6721: Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability. Affects bouncycastle:bcprov-jdk14 versions < 1.38. Fixed in 1.38. How to fix ↓
Also tracked for
- bouncycastle · Debian:11
The same CVE-2007-6721 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bouncycastle:bcprov-jdk14 package is a Java Cryptography API that provides a wide range of cryptographic algorithms and protocols. It is commonly used for secure communication, data encryption, and digital signatures. However, versions before 1.38 of this package are vulnerable to a Bleichenbacher Oracle attack in simple RSA CMS signatures without signed attributes.
Vulnerability Detail
The vulnerability in bouncycastle:bcprov-jdk14 allows remote attackers to exploit a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes. The impact and attack vectors of this vulnerability are currently unknown. This vulnerability has a high severity rating and is classified under CWE-203.
How To Fix
Minimum fixed version
1.38
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version as soon as possible.
Conclusion
The bouncycastle:bcprov-jdk14 package is vulnerable to a Bleichenbacher Oracle attack in simple RSA CMS signatures without signed attributes. To mitigate this vulnerability, it is crucial to update the package to version 1.38 or later. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bouncycastle:bcprov-jdk14 →
FAQ
The impact of this vulnerability is currently unknown. It is recommended to update the package to the fixed version to mitigate any potential risks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, all versions before 1.38 of the bouncycastle:bcprov-jdk14 package are affected by this vulnerability. It is crucial to update to the fixed version.
There is currently no known exploit for this vulnerability. However, it is still recommended to update the package to the fixed version to prevent any potential attacks.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to the vulnerability details]
