NetSight
IP …
medium5.0

CVE-2015-7940

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain privat…

Impact

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

Affected products

VendorProductAffected versions
OpensuseLeap
Version 42.1
OpensuseOpensuse
Versions 13.1, 13.2
BouncycastleBouncy Castle Crypto Package
through 1.50
OracleApplication Testing Suite
Versions 12.5.0.1, 12.5.0.2, 12.5.0.3
OracleEnterprise Manager Ops Center
Versions 12.1.4, 12.2.2
OraclePeoplesoft Enterprise Peopletools
Versions 8.54, 8.55
OracleVirtual Desktop Infrastructure
Version 3.5.2

Weakness classification

CWE-200CWE-310

References