CVE-2019-3740 in StorageTek ACSLS
Summary
by MITRE
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified as CVE-2019-3740 affects RSA BSAFE Crypto-J cryptographic library versions prior to 6.2.5, specifically targeting the DSA key generation process. This represents a critical information exposure weakness that stems from timing discrepancies during cryptographic operations, creating a pathway for sophisticated attackers to potentially reconstruct sensitive DSA private keys through careful analysis of execution timing variations.
The technical flaw manifests as a timing side-channel vulnerability during DSA key generation where the cryptographic library exhibits measurable differences in execution time based on the input values being processed. This timing variation occurs because the library does not implement constant-time algorithms for the modular exponentiation operations required in DSA key generation. Attackers can exploit this by monitoring execution time patterns and using statistical analysis to infer information about the private key components, ultimately leading to key recovery. The vulnerability aligns with CWE-385, which specifically addresses timing attacks and side-channel attacks that can be exploited through timing discrepancies in cryptographic implementations.
The operational impact of this vulnerability extends beyond simple information disclosure, as DSA private key recovery would compromise the integrity of digital signatures and authentication mechanisms that rely on these keys. Organizations using affected versions of RSA BSAFE Crypto-J may experience significant security degradation, particularly in environments where DSA signatures are used for code signing, document authentication, or secure communications. The vulnerability affects systems across various industries including financial services, government agencies, and enterprise environments that depend on robust cryptographic implementations for security assurance.
Mitigation strategies should prioritize immediate upgrading to RSA BSAFE Crypto-J version 6.2.5 or later, which implements proper constant-time algorithms to eliminate the timing discrepancies. Organizations should also consider implementing additional monitoring for unusual timing patterns in cryptographic operations and review their cryptographic libraries for similar timing vulnerabilities. The remediation process should include comprehensive testing to ensure that the updated library functions correctly without introducing regressions in existing applications. Security teams should also conduct vulnerability assessments across their infrastructure to identify other potential instances of similar timing side-channel vulnerabilities in cryptographic implementations, following ATT&CK framework's T1005 technique for data from local system repositories and T1046 for network service scanning that may reveal vulnerable systems.