Filtered by vendor Bouncycastle Subscriptions
Filtered by product Bc-java Subscriptions

Search

Switch to Advanced Search (Beta)
Total 25 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-13098 1 Bouncycastle 1 Bc-java 2025-05-12 N/A
BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."
CVE-2016-1000341 3 Bouncycastle, Debian, Redhat 5 Bc-java, Debian Linux, Jboss Fuse and 2 more 2025-05-12 N/A
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
CVE-2016-1000352 2 Bouncycastle, Redhat 4 Bc-java, Jboss Fuse, Satellite and 1 more 2025-05-12 N/A
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
CVE-2020-28052 4 Apache, Bouncycastle, Oracle and 1 more 27 Karaf, Bc-java, Banking Corporate Lending Process Management and 24 more 2025-05-12 8.1 High
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
CVE-2023-33201 2 Bouncycastle, Redhat 10 Bc-java, Amq Broker, Amq Streams and 7 more 2024-12-04 5.3 Medium
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.