Junglewise Threat Intelligence
CVE-2024-30171: Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")
CVE-2024-30171 · Severity: low · CVSS 3.1 · Published 2024-05-14
Technologies: BouncyCastle.Cryptography (NuGet), org.bouncycastle:bctls-jdk18on (Maven), org.bouncycastle:bcprov-jdk14 (Maven), org.bouncycastle:bctls-jdk14 (Maven), org.bouncycastle:bctls-fips (Maven), org.bouncycastle:bctls-jdk15to18 (Maven), org.bouncycastle:bcprov-jdk18on (Maven), org.bouncycastle:bcprov-jdk15on (Maven), org.bouncycastle:bcprov-jdk15to18 (Maven), BouncyCastle (NuGet). Vendors: NuGet, Maven.
Executive brief
Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")
Affected products
- NuGet BouncyCastle.Cryptography
- Maven org.bouncycastle:bctls-jdk18on
- Maven org.bouncycastle:bcprov-jdk14
- Maven org.bouncycastle:bctls-jdk14
- Maven org.bouncycastle:bctls-fips
- Maven org.bouncycastle:bctls-jdk15to18
- Maven org.bouncycastle:bcprov-jdk18on
- Maven org.bouncycastle:bcprov-jdk15on
- Maven org.bouncycastle:bcprov-jdk15to18
- NuGet BouncyCastle