| Package | Affected versions | Patched versions |
|---|---|---|
| org.bouncycastle:bcprov-jdk15on | < 1.0.3 | 1.0.3 |
| bc-java | < 1.59 | 1.59 |
BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free