| Package | Affected versions | Patched versions |
|---|---|---|
| org.bouncycastle:bcprov-jdk15on | < 1.48 | 1.48 |
| bc-java | = 1.01= 1.02= 1.03= 1.04= 1.05= 1.06= 1.07= 1.08= 1.09= 1.10= 1.11= 1.12= 1.13= 1.14= 1.15= 1.16= 1.17= 1.18= 1.19= 1.20= 1.21= 1.22= 1.23= 1.24= 1.25= 1.26= 1.27= 1.28= 1.29= 1.30= 1.31= 1.32= 1.33= 1.34= 1.35= 1.36= 1.37= 1.38= 1.39= 1.40= 1.41= 1.42= 1.43= 1.44= 1.45= 1.46= 1.47 | |
| legion-of-the-bouncy-castle-c#-cryptography-api | = 0.0= 1.0= 1.1= 1.2= 1.3= 1.4= 1.5= 1.6.1= 1.7 |
The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free