CVE-2017-13098 BouncyCastle JCE TLS Bleichenbacher/ROBOT

What is CVE-2017-13098?

CVE-2017-13098 is a high-severity vulnerability in Bouncycastle Bc-Java, published on 13 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."

Weakness: CWE-203

Which versions are affected by CVE-2017-13098?

2 open source packages ship an affected version, including org.bouncycastle:bcprov-jdk15on. It affects 1 product.

Products include Bouncycastle Bc-Java.

How do I fix CVE-2017-13098?

Upgrade org.bouncycastle:bcprov-jdk15on to 1.0.3 or later.

Is CVE-2017-13098 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-13098 exists.

Public exploit code: 1 Metasploit module.

Other vulnerabilities in Bouncycastle Bc-Java

• CVE-2007-6721 Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability Critical 10.0
• CVE-2018-1000613 Deserialization of Untrusted Data in Bouncy castle Critical 9.8
• CVE-2026-58062 Stapled OCSP response accepted without binding to the checked certificate Critical 9.3
• CVE-2026-59638 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in Critical 9.3
• CVE-2026-59650 MTI/A0 DH agreement exponentiates unvalidated peer value Critical 9.3

All Bouncycastle Bc-Java vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-13098, DSA-4072-1, GHSA-wrwf-pmmj-w989.