CVE-2017-13098
CVE-2017-13098 · BouncyCastle JCE TLS Bleichenbacher/ROBOT
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."
CVSS 7.5 · Alta · EPSS 24,3% · Código de explotación público · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
bouncycastle tls
- Versiones
- <1.0.3: Afectada
Sin corrección publicada
bouncycastle Debian:12
- Intervalos de versiones afectados
- ECOSYSTEM: < 1.58-1
Actualiza a 1.58-1
bouncycastle Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 1.58-1
Actualiza a 1.58-1
bouncycastle Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 1.58-1
Actualiza a 1.58-1
Fuentes originales
- http://www.securityfocus.com/bid/102195
- http://www.kb.cert.org/vuls/id/144389
- https://www.debian.org/security/2017/dsa-4072
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://robotattack.org/
- https://github.com/bcgit/bc-java/commit/a00b684465b38d722ca9a3543b8af8568e6bad5c
- https://security.netapp.com/advisory/ntap-20171222-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2017-13098