CVE-2007-6721
First published: Mon Mar 30 2009(Updated: )
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/bouncycastle:bcprov-jdk16 | <1.38 | 1.38 |
| maven/bouncycastle:bcprov-jdk14 | <1.38 | 1.38 |
| Bouncy Castle Crypto Package | <=1.37 | |
| Bouncy Castle Crypto Package | =1.01 | |
| Bouncy Castle Crypto Package | =1.02 | |
| Bouncy Castle Crypto Package | =1.03 | |
| Bouncy Castle Crypto Package | =1.04 | |
| Bouncy Castle Crypto Package | =1.05 | |
| Bouncy Castle Crypto Package | =1.06 | |
| Bouncy Castle Crypto Package | =1.07 | |
| Bouncy Castle Crypto Package | =1.08 | |
| Bouncy Castle Crypto Package | =1.09 | |
| Bouncy Castle Crypto Package | =1.10 | |
| Bouncy Castle Crypto Package | =1.11 | |
| Bouncy Castle Crypto Package | =1.12 | |
| Bouncy Castle Crypto Package | =1.13 | |
| Bouncy Castle Crypto Package | =1.14 | |
| Bouncy Castle Crypto Package | =1.15 | |
| Bouncy Castle Crypto Package | =1.16 | |
| Bouncy Castle Crypto Package | =1.17 | |
| Bouncy Castle Crypto Package | =1.18 | |
| Bouncy Castle Crypto Package | =1.19 | |
| Bouncy Castle Crypto Package | =1.20 | |
| Bouncy Castle Crypto Package | =1.21 | |
| Bouncy Castle Crypto Package | =1.22 | |
| Bouncy Castle Crypto Package | =1.23 | |
| Bouncy Castle Crypto Package | =1.24 | |
| Bouncy Castle Crypto Package | =1.25 | |
| Bouncy Castle Crypto Package | =1.26 | |
| Bouncy Castle Crypto Package | =1.27 | |
| Bouncy Castle Crypto Package | =1.28 | |
| Bouncy Castle Crypto Package | =1.29 | |
| Bouncy Castle Crypto Package | =1.30 | |
| Bouncy Castle Crypto Package | =1.31 | |
| Bouncy Castle Crypto Package | =1.32 | |
| Bouncy Castle Crypto Package | =1.33 | |
| Bouncy Castle Crypto Package | =1.34 | |
| Bouncy Castle Crypto Package | =1.35 | |
| Bouncy Castle Crypto Package | =1.36 | |
| Bouncy Castle Crypto Package | <=1.35 | |
| Bouncy Castle Crypto Package | =1.0 | |
| Bouncy Castle Crypto Package | =1.01 | |
| Bouncy Castle Crypto Package | =1.02 | |
| Bouncy Castle Crypto Package | =1.03 | |
| Bouncy Castle Crypto Package | =1.3.1 | |
| Bouncy Castle Crypto Package | =1.04 | |
| Bouncy Castle Crypto Package | =1.05 | |
| Bouncy Castle Crypto Package | =1.06 | |
| Bouncy Castle Crypto Package | =1.07 | |
| Bouncy Castle Crypto Package | =1.08 | |
| Bouncy Castle Crypto Package | =1.09 | |
| Bouncy Castle Crypto Package | =1.11 | |
| Bouncy Castle Crypto Package | =1.12 | |
| Bouncy Castle Crypto Package | =1.13 | |
| Bouncy Castle Crypto Package | =1.14 | |
| Bouncy Castle Crypto Package | =1.15 | |
| Bouncy Castle Crypto Package | =1.16 | |
| Bouncy Castle Crypto Package | =1.17 | |
| Bouncy Castle Crypto Package | =1.18 | |
| Bouncy Castle Crypto Package | =1.19 | |
| Bouncy Castle Crypto Package | =1.20 | |
| Bouncy Castle Crypto Package | =1.21 | |
| Bouncy Castle Crypto Package | =1.22 | |
| Bouncy Castle Crypto Package | =1.23 | |
| Bouncy Castle Crypto Package | =1.24 | |
| Bouncy Castle Crypto Package | =1.25 | |
| Bouncy Castle Crypto Package | =1.26 | |
| Bouncy Castle Crypto Package | =1.27 | |
| Bouncy Castle Crypto Package | =1.28 | |
| Bouncy Castle Crypto Package | =1.29 | |
| Bouncy Castle Crypto Package | =1.30 | |
| Bouncy Castle Crypto Package | =1.32 | |
| Bouncy Castle Crypto Package | =1.33 | |
| Bouncy Castle Crypto Package | =1.34 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.osvdb.org/50360
- http://freshmeat.net/projects/bouncycastlecryptoapi/releases/265580
- http://www.bouncycastle.org/devmailarchive/msg08195.html
- http://www.osvdb.org/50358
- http://www.bouncycastle.org/csharp/
- http://www.osvdb.org/50359
- http://www.bouncycastle.org/releasenotes.html
- https://nvd.nist.gov/vuln/detail/CVE-2007-6721
- https://web.archive.org/web/20071022023551/http://www.bouncycastle.org/csharp/
- https://web.archive.org/web/20080316202318/http://www.bouncycastle.org:80/releasenotes.html
- https://github.com/advisories/GHSA-m26p-m559-g5j5 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2007-6721?
CVE-2007-6721 has an unknown severity due to its complex nature and the lack of detailed impact assessment.
How do I fix CVE-2007-6721?
To fix CVE-2007-6721, upgrade to the Bouncy Castle Java Cryptography API version 1.38 or later.
What are the affected versions for CVE-2007-6721?
CVE-2007-6721 affects all versions of the Bouncy Castle API prior to version 1.38.
Who is affected by CVE-2007-6721?
Any application utilizing versions of the Bouncy Castle Java Cryptography API before 1.38 may be vulnerable to CVE-2007-6721.
What kind of vulnerability is CVE-2007-6721?
CVE-2007-6721 is related to a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes.
- collector/nvd-historical
- collector/github-advisory-latest
- alias/GHSA-m26p-m559-g5j5
- alias/CVE-2007-6721
- collector/github-advisory
- agent/author
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/maven
- vendor/bouncycastle
- canonical/bouncy castle crypto package
- version/bouncy castle crypto package/1.37
- version/bouncy castle crypto package/1.01
- version/bouncy castle crypto package/1.02
- version/bouncy castle crypto package/1.03
- version/bouncy castle crypto package/1.04
- version/bouncy castle crypto package/1.05
- version/bouncy castle crypto package/1.06
- version/bouncy castle crypto package/1.07
- version/bouncy castle crypto package/1.08
- version/bouncy castle crypto package/1.09
- version/bouncy castle crypto package/1.10
- version/bouncy castle crypto package/1.11
- version/bouncy castle crypto package/1.12
- version/bouncy castle crypto package/1.13
- version/bouncy castle crypto package/1.14
- version/bouncy castle crypto package/1.15
- version/bouncy castle crypto package/1.16
- version/bouncy castle crypto package/1.17
- version/bouncy castle crypto package/1.18
- version/bouncy castle crypto package/1.19
- version/bouncy castle crypto package/1.20
- version/bouncy castle crypto package/1.21
- version/bouncy castle crypto package/1.22
- version/bouncy castle crypto package/1.23
- version/bouncy castle crypto package/1.24
- version/bouncy castle crypto package/1.25
- version/bouncy castle crypto package/1.26
- version/bouncy castle crypto package/1.27
- version/bouncy castle crypto package/1.28
- version/bouncy castle crypto package/1.29
- version/bouncy castle crypto package/1.30
- version/bouncy castle crypto package/1.31
- version/bouncy castle crypto package/1.32
- version/bouncy castle crypto package/1.33
- version/bouncy castle crypto package/1.34
- version/bouncy castle crypto package/1.35
- version/bouncy castle crypto package/1.36
- version/bouncy castle crypto package/1.0
- version/bouncy castle crypto package/1.3.1