Junglewise Threat Intelligence

CVE-2020-15522: Timing based private key exposure in Bouncy Castle

CVE-2020-15522 · Severity: low · CVSS 3.1 · Published 2021-08-13

Technologies: org.bouncycastle:bcprov-ext-jdk16 (Maven), org.bouncycastle:bc-fips (Maven), org.bouncycastle:bcprov-jdk14 (Maven), org.bouncycastle:bcprov-jdk15 (Maven), org.bouncycastle:bcprov-jdk16 (Maven), BouncyCastle (NuGet), org.bouncycastle:bcprov-jdk15on (Maven), org.bouncycastle:bcprov-jdk15to18 (Maven), org.bouncycastle:bcprov-ext-jdk15on (Maven). Vendors: Maven, NuGet.

Executive brief

Timing based private key exposure in Bouncy Castle

Affected products

  • Maven org.bouncycastle:bcprov-ext-jdk16
  • Maven org.bouncycastle:bc-fips
  • Maven org.bouncycastle:bcprov-jdk14
  • Maven org.bouncycastle:bcprov-jdk15
  • Maven org.bouncycastle:bcprov-jdk16
  • NuGet BouncyCastle
  • Maven org.bouncycastle:bcprov-jdk15on
  • Maven org.bouncycastle:bcprov-jdk15to18
  • Maven org.bouncycastle:bcprov-ext-jdk15on

Related threats