Direct naar de inhoud
⚡ Kritieke cyberalerts voor jouw sector & systemen — direct in je inbox. Aanmelden →
cybernieuws.nl Cybersecurity en informatiebeveiling nieuws alerts live · net nu 132 bronnen 1 kritiek 3 vandaag
CVE's Videos Dagbriefing

← Terug naar CVE-database

CVE-2015-7940

MEDIUM · 5.0 CVSS Gepubliceerd: CWE-200

Beschrijving

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

Vendors

Opensuse Bouncycastle Oracle

Affected products

Leap Opensuse Bouncy Castle Crypto Package Application Testing Suite Enterprise Manager Ops Center Peoplesoft Enterprise Peopletools Virtual Desktop Infrastructure

References