CVE-2015-7940
Fixed in a distro release EPSS 5%
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Products: opensuse leap, opensuse, bouncycastle bouncy-castle-crypto-package, oracle application_testing_suite, oracle enterprise_manager_ops_center, oracle peoplesoft_enterprise_peopletools, oracle virtual_desktop_infrastructure
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.bouncycastle:bcprov-jdk14 | 1.51 |
| Maven | org.bouncycastle:bcprov-jdk15 | 1.51 |
| Maven | org.bouncycastle:bcprov-jdk15on | 1.51 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | eco-java-gradle-1.11 | no fix |
| Chainguard | eco-java-gradle-2.0 | no fix |
| Chainguard | eco-java-gradle-2.1 | no fix |
| Chainguard | eco-java-gradle-2.2 | no fix |
| Chainguard | eco-java-gradle-2.2.1 | no fix |
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Debian 12 | bouncycastle | 1.51-1 |
| Debian 13 | bouncycastle | 1.51-1 |
| Debian 14 | bouncycastle | 1.51-1 |
| Debian 6.0 | bouncycastle | 1.44+dfsg-2+deb6u1 |
| Debian 7 | bouncycastle | 1.44+dfsg-3.1+deb7u1 |
| Debian 8 | bouncycastle | 1.49+dfsg-3+deb8u1 |
| Ubuntu 14.04 LTS | bouncycastle | 1.49+dfsg-2ubuntu0.1 |
| openSUSE Tumbleweed | bouncycastle | 1.54-1.2 |