First published: Thu May 20 2021(Updated: )
A flaw was found in bouncycastle. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Bouncycastle Bc-csharp | <1.8.7 | |
Bouncycastle Bouncy Castle Fips .net Api | <1.0.1.1 | |
Bouncycastle Legion-of-the-bouncy-castle-fips-java-api | <1.0.1.2 | |
Bouncycastle Legion-of-the-bouncy-castle-fips-java-api | >=1.0.2<1.0.2.1 | |
Bouncycastle The Bouncy Castle Crypto Package For Java | <1.66 | |
redhat/bouncycastle | <1.66 | 1.66 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
The vulnerability ID is CVE-2020-15522.
The severity rating of CVE-2020-15522 is medium with a CVSS score of 5.9.
Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.2.1, BC before 1.66, BC-FNA before 1.0.1.1.
To fix CVE-2020-15522, update Bouncy Castle BC Java to version 1.66 or higher, BC C# .NET to version 1.8.7 or higher, BC-FJA to version 1.0.2.1 or higher, and BC-FNA to version 1.0.1.1 or higher.
More information about CVE-2020-15522 can be found at the following references: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-15522), [GitHub - bc-csharp](https://github.com/bcgit/bc-csharp/wiki/CVE-2020-15522), [GitHub - bc-java](https://github.com/bcgit/bc-java/wiki/CVE-2020-15522).