CVE-2015-7940 Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Remote attackers can obtain private keys via invalid curve attacks in the Bouncy Castle Java library due to missing elliptic curve validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-7940?
CVE-2015-7940 is a medium-severity vulnerability in Opensuse Leap, published on 9 Nov 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Which versions are affected by CVE-2015-7940?
6 open source packages ship an affected version, including org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15 and org.bouncycastle:bcprov-jdk15on. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
org.bouncycastle:bcprov-jdk14 Maven | All versions | 1.51 |
org.bouncycastle:bcprov-jdk14 Maven | All versions | 1.51 |
org.bouncycastle:bcprov-jdk15 Maven | All versions | 1.51 |
org.bouncycastle:bcprov-jdk15 Maven | All versions | 1.51 |
org.bouncycastle:bcprov-jdk15on Maven | All versions | 1.51 |
org.bouncycastle:bcprov-jdk15on Maven | All versions | 1.51 |
Products include Bouncycastle Bouncy Castle Crypto Package, Opensuse Leap, Opensuse Opensuse, Oracle Application Testing Suite, Oracle Enterprise Manager Ops Center, Oracle Peoplesoft Enterprise Peopletools and 1 more.
How do I fix CVE-2015-7940?
Upgrade org.bouncycastle:bcprov-jdk14 to 1.51 or later.
Is CVE-2015-7940 being exploited?
There is no known exploitation of CVE-2015-7940 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2015-7940, DLA-361-1, DSA-3417-1, GHSA-4mv7-cq75-3qjm, MGASA-2015-0487, UBUNTU-CVE-2015-7940.