The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library…
Priority LOW 24CWE-310Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · None
- Fix status
- Partial Red Hat: 6 fixed, 8 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Why it matters now
EPSS 0.02972 87th percentileScored 2026-11-07
Fix Partial org.bouncycastle:bcprov-jdk15on (Maven): 1.48Red Hat: 6 advisoriesRed Hat: 6 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.bouncycastle:bcprov-jdk15on (Maven) | before 1.48 | 1.48 | Patch available | GHSA-8353-fgcr-xfhx |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.bouncycastle:bcprov-jdk15on (Maven) Vendor— Affected before 1.48 Fixed in 1.48 Patch available GHSA-8353-fgcr-xfhx
CPE configurations NVD · 56
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bouncycastle:bc-java:1.01:*:*:*:*:*:*:* | 1.01 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.02:*:*:*:*:*:*:* | 1.02 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.03:*:*:*:*:*:*:* | 1.03 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.04:*:*:*:*:*:*:* | 1.04 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.05:*:*:*:*:*:*:* | 1.05 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.06:*:*:*:*:*:*:* | 1.06 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.07:*:*:*:*:*:*:* | 1.07 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.08:*:*:*:*:*:*:* | 1.08 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.09:*:*:*:*:*:*:* | 1.09 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.10:*:*:*:*:*:*:* | 1.10 | Vulnerable | Legion of the Bouncy Castle Inc. |
- cpe:2.3:a:bouncycastle:bc-java:1.01:*:*:*:*:*:*:* Versions 1.01 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.02:*:*:*:*:*:*:* Versions 1.02 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.03:*:*:*:*:*:*:* Versions 1.03 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.04:*:*:*:*:*:*:* Versions 1.04 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.05:*:*:*:*:*:*:* Versions 1.05 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.06:*:*:*:*:*:*:* Versions 1.06 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.07:*:*:*:*:*:*:* Versions 1.07 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.08:*:*:*:*:*:*:* Versions 1.08 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.09:*:*:*:*:*:*:* Versions 1.09 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Legion of the Bouncy Castle Inc.
Show 46 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bouncycastle:bc-java:1.11:*:*:*:*:*:*:* | 1.11 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.12:*:*:*:*:*:*:* | 1.12 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.13:*:*:*:*:*:*:* | 1.13 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.14:*:*:*:*:*:*:* | 1.14 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.15:*:*:*:*:*:*:* | 1.15 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.16:*:*:*:*:*:*:* | 1.16 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.17:*:*:*:*:*:*:* | 1.17 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.18:*:*:*:*:*:*:* | 1.18 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.19:*:*:*:*:*:*:* | 1.19 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.20:*:*:*:*:*:*:* | 1.20 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.21:*:*:*:*:*:*:* | 1.21 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.22:*:*:*:*:*:*:* | 1.22 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.23:*:*:*:*:*:*:* | 1.23 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.24:*:*:*:*:*:*:* | 1.24 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.25:*:*:*:*:*:*:* | 1.25 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.26:*:*:*:*:*:*:* | 1.26 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.27:*:*:*:*:*:*:* | 1.27 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.28:*:*:*:*:*:*:* | 1.28 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.29:*:*:*:*:*:*:* | 1.29 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.30:*:*:*:*:*:*:* | 1.30 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.31:*:*:*:*:*:*:* | 1.31 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.32:*:*:*:*:*:*:* | 1.32 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.33:*:*:*:*:*:*:* | 1.33 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.34:*:*:*:*:*:*:* | 1.34 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.35:*:*:*:*:*:*:* | 1.35 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.36:*:*:*:*:*:*:* | 1.36 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.37:*:*:*:*:*:*:* | 1.37 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.38:*:*:*:*:*:*:* | 1.38 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.39:*:*:*:*:*:*:* | 1.39 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.40:*:*:*:*:*:*:* | 1.40 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.41:*:*:*:*:*:*:* | 1.41 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.42:*:*:*:*:*:*:* | 1.42 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.43:*:*:*:*:*:*:* | 1.43 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.44:*:*:*:*:*:*:* | 1.44 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.45:*:*:*:*:*:*:* | 1.45 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.46:*:*:*:*:*:*:* | 1.46 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.47:*:*:*:*:*:*:* | 1.47 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:0.0:*:*:*:*:*:*:* | 0.0 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.1:*:*:*:*:*:*:* | 1.1 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.2:*:*:*:*:*:*:* | 1.2 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.3:*:*:*:*:*:*:* | 1.3 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.4:*:*:*:*:*:*:* | 1.4 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.5:*:*:*:*:*:*:* | 1.5 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.6.1:*:*:*:*:*:*:* | 1.6.1 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.7:*:*:*:*:*:*:* | 1.7 | Vulnerable | Legion of the Bouncy Castle Inc. |
- cpe:2.3:a:bouncycastle:bc-java:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.16:*:*:*:*:*:*:* Versions 1.16 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.17:*:*:*:*:*:*:* Versions 1.17 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.18:*:*:*:*:*:*:* Versions 1.18 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.19:*:*:*:*:*:*:* Versions 1.19 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.20:*:*:*:*:*:*:* Versions 1.20 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.21:*:*:*:*:*:*:* Versions 1.21 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.22:*:*:*:*:*:*:* Versions 1.22 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.23:*:*:*:*:*:*:* Versions 1.23 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.24:*:*:*:*:*:*:* Versions 1.24 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.25:*:*:*:*:*:*:* Versions 1.25 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.26:*:*:*:*:*:*:* Versions 1.26 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.27:*:*:*:*:*:*:* Versions 1.27 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.28:*:*:*:*:*:*:* Versions 1.28 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.29:*:*:*:*:*:*:* Versions 1.29 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.30:*:*:*:*:*:*:* Versions 1.30 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.31:*:*:*:*:*:*:* Versions 1.31 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.32:*:*:*:*:*:*:* Versions 1.32 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.33:*:*:*:*:*:*:* Versions 1.33 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.34:*:*:*:*:*:*:* Versions 1.34 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.35:*:*:*:*:*:*:* Versions 1.35 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.36:*:*:*:*:*:*:* Versions 1.36 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.37:*:*:*:*:*:*:* Versions 1.37 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.38:*:*:*:*:*:*:* Versions 1.38 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.39:*:*:*:*:*:*:* Versions 1.39 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.40:*:*:*:*:*:*:* Versions 1.40 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.41:*:*:*:*:*:*:* Versions 1.41 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.42:*:*:*:*:*:*:* Versions 1.42 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.43:*:*:*:*:*:*:* Versions 1.43 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.44:*:*:*:*:*:*:* Versions 1.44 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.45:*:*:*:*:*:*:* Versions 1.45 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.46:*:*:*:*:*:*:* Versions 1.46 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.47:*:*:*:*:*:*:* Versions 1.47 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:0.0:*:*:*:*:*:*:* Versions 0.0 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-c\#-cryptography-api:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Legion of the Bouncy Castle Inc.
Remediation
- Fix · GHSA-8353-fgcr-xfhx org.bouncycastle:bcprov-jdk15on (Maven) Fixed in 1.48 Advisory →
Red Hat 6 advisories
- RHSA-2015:1009 Released 2015-05-14 · Red Hat rating ImportantRed Hat JBoss Portal 6.2.0 update
- Red Hat JBoss Portal 6.2
- RHSA-2014:0896 Released 2014-07-16 · Red Hat rating ModerateRed Hat JBoss Web Framework Kit 2.6.0 update
- Red Hat JBoss Web Framework Kit 2.6
- RHSA-2014:0400 Released 2014-04-14 · Red Hat rating ModerateRed Hat JBoss Fuse 6.1.0 update
- Red Hat JBoss Fuse 6.1
Show 3 more Red Hat advisories
- RHSA-2014:0401 Released 2014-04-14 · Red Hat rating ModerateRed Hat JBoss A-MQ 6.1.0 update
- Red Hat JBoss A-MQ 6.1
- RHSA-2014:0372 Released 2014-04-03 · Red Hat rating ImportantRed Hat JBoss BRMS 6.0.1 update
- Red Hat JBoss BRMS 6.0
- RHSA-2014:0371 Released 2014-04-03 · Red Hat rating ImportantRed Hat JBoss BPM Suite 6.0.1 update
- Red Hat JBoss BPMS 6.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Enterprise 1 | Affected | No fix planned: Will not fix |
| Red Hat BPM Suite 6 | Affected | No fix yet |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss BRMS 6 | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix yet |
| Red Hat JBoss Portal 5 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix planned: Will not fix |
| Red Hat Subscription Asset Manager | Affected | No fix planned: Will not fix |
| Red Hat JBoss A-MQ 6.1 | Fixed | RHSA-2014:0401 |
| Red Hat JBoss BPMS 6.0 | Fixed | RHSA-2014:0371 |
| Red Hat JBoss BRMS 6.0 | Fixed | RHSA-2014:0372 |
| Red Hat JBoss Fuse 6.1 | Fixed | RHSA-2014:0400 |
| Red Hat JBoss Portal 6.2 | Fixed | RHSA-2015:1009 |
| Red Hat JBoss Web Framework Kit 2.6 | Fixed | RHSA-2014:0896 |
Not affected: 1 product
- Red Hat Enterprise Virtualization 3
Timeline
- 2026-10-02 Threatist record created from CVE-2013-1624
- 2026-10-03 Alias added: GHSA-8353-fgcr-xfhx
References
More Legion of the Bouncy Castle Inc. Bc-java vulnerabilities
- TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
- TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
- TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
- TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
- TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
- TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3
Sources
- CVE-2013-1624 · CVE Program
- CVE-2013-1624 · NVD
- FIRST EPSS
- GHSA-8353-fgcr-xfhx · GitHub Advisory Database · CC BY 4.0
- CVE-2013-1624 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences