CVE-2018-11070

MEDIUM

RSA BSAFE Crypto-J and SSL-J < 6.2.4 - Covert Timing Channel during PKCS #1 Unpadding

Title source: llm

Description

RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during PKCS #1 unpadding operations, also known as a Bleichenbacher attack. A remote attacker may be able to recover a RSA key.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1041615

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1041614

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

https://seclists.org/fulldisclosure/2018/Sep/7

Scores

CVSS v3 5.9

EPSS 0.0033

EPSS Percentile 56.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-327

Status published

Products (2)

dell/bsafe_crypto-j < 6.2.4

dell/rsa_bsafe_ssl-j < 6.2.4

Published Sep 11, 2018

Tracked Since Feb 18, 2026