BouncyCastle up to 1.77 Cryptography API Marvin Attack timing discrepancy

Summaryinfo

A vulnerability, which was classified as problematic, was found in BouncyCastle up to 1.77. This issue affects some unknown processing of the component Cryptography API. Such manipulation leads to timing discrepancy. This vulnerability is traded as CVE-2024-30171. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in BouncyCastle up to 1.77 and classified as problematic. Affected by this issue is some unknown functionality of the component Cryptography API. The manipulation with an unknown input leads to a timing discrepancy vulnerability. Using CWE to declare the problem leads to CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. Impacted is confidentiality.

The advisory is available at bugzilla.redhat.com. This vulnerability is handled as CVE-2024-30171 since 03/24/2024. The exploitation is known to be difficult. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 232084 (Linux Distros Unpatched Vulnerability : CVE-2024-30171), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.78 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (232084). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• BouncyCastle

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47
• 1.48
• 1.49
• 1.50
• 1.51
• 1.52
• 1.53
• 1.54
• 1.55
• 1.56
• 1.57
• 1.58
• 1.59
• 1.60
• 1.61
• 1.62
• 1.63
• 1.64
• 1.65
• 1.66
• 1.67
• 1.68
• 1.69
• 1.70
• 1.71
• 1.72
• 1.73
• 1.74
• 1.75
• 1.76
• 1.77

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion