| Package | Affected versions | Patched versions |
|---|---|---|
| org.bouncycastle:bcprov-jdk14 | < 1.51 | 1.51 |
| org.bouncycastle:bcprov-jdk15 | < 1.51 | 1.51 |
| org.bouncycastle:bcprov-jdk15on | < 1.51 | 1.51 |
| bouncy castle crypto package | ≤ 1.50 | |
| application testing suite | = 12.5.0.1= 12.5.0.2= 12.5.0.3 | |
| enterprise manager ops center | = 12.1.4= 12.2.2 | |
| peoplesoft enterprise peopletools | = 8.54= 8.55 | |
| virtual desktop infrastructure | = 3.5.2 |
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free