NVD

Id
28335  
Name
CVE-2015-7940  
Description
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2015-11-09  
Modified Date
2016-12-07  
Seq
2015-7940  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
148856 28335 CVE-2015-7940 FEDORA-2015-7d95466eda  View
148857 28335 CVE-2015-7940 openSUSE-SU-2015:1911  View
148858 28335 CVE-2015-7940 http://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html  View
148859 28335 CVE-2015-7940 DSA-3417  View
148860 28335 CVE-2015-7940 [oss-security] 20151022 CVE Request: invalid curve attack on bouncycastle  View
148861 28335 CVE-2015-7940 [oss-security] 20151022 Re: CVE Request: invalid curve attack on bouncycastle  View
148862 28335 CVE-2015-7940 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html  View
148863 28335 CVE-2015-7940 79091  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
10506 JVNDB-2015-005826 Bouncy Castle Java ライブラリにおける秘密鍵を取得される脆弱性 Bouncy Castle Java ライブラリは、点 (point) が楕円曲線 (elliptic curve) の範囲内にあることを検証しないため、秘密鍵を取得される脆弱性が存在します。 CVE-2015-7940 85165 CVE-2015-7940 28335 5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-005826.html 2015-11-04 2016-11-22 View