Read the docs
TI-2015-06606 Aliases CVE-2015-7940GHSA-4mv7-cq75-3qjm

The Bouncy Castle Java library before 1.51 does not validate a point is withing the…

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 2 fixed, 4 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

Why it matters now

EPSS 0.0469 91st percentileScored 2026-11-07
Fix Partial org.bouncycastle:bcprov-jdk15 (Maven): 1.51org.bouncycastle:bcprov-jdk14 (Maven): 1.51+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.bouncycastle:bcprov-jdk15 (Maven)before 1.511.51Patch availableGHSA-4mv7-cq75-3qjm
—org.bouncycastle:bcprov-jdk14 (Maven)before 1.511.51Patch availableGHSA-4mv7-cq75-3qjm
—org.bouncycastle:bcprov-jdk15on (Maven)before 1.511.51Patch availableGHSA-4mv7-cq75-3qjm
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.bouncycastle:bcprov-jdk15 (Maven) Vendor— Affected before 1.51 Fixed in 1.51 Patch available GHSA-4mv7-cq75-3qjm
  • org.bouncycastle:bcprov-jdk14 (Maven) Vendor— Affected before 1.51 Fixed in 1.51 Patch available GHSA-4mv7-cq75-3qjm
  • org.bouncycastle:bcprov-jdk15on (Maven) Vendor— Affected before 1.51 Fixed in 1.51 Patch available GHSA-4mv7-cq75-3qjm

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*42.1VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*13.1VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*13.2VulnerableopenSUSE
cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:*:*:*:*:*:*:*:*up to 1.50VulnerableLegion of the Bouncy Castle Inc.
cpe:2.3:a:oracle:application_testing_suite:12.5.0.1:*:*:*:*:*:*:*12.5.0.1VulnerableOracle
cpe:2.3:a:oracle:application_testing_suite:12.5.0.2:*:*:*:*:*:*:*12.5.0.2VulnerableOracle
cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*12.5.0.3VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1.4:*:*:*:*:*:*:*12.1.4VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*12.2.2VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.54:*:*:*:*:*:*:*8.54VulnerableOracle
  • cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* Versions 42.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE
  • cpe:2.3:a:bouncycastle:bouncy_castle_crypto_package:*:*:*:*:*:*:*:* Versions up to 1.50 Vulnerable ·Legion of the Bouncy Castle Inc.
  • cpe:2.3:a:oracle:application_testing_suite:12.5.0.1:*:*:*:*:*:*:* Versions 12.5.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_testing_suite:12.5.0.2:*:*:*:*:*:*:* Versions 12.5.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:* Versions 12.5.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1.4:*:*:*:*:*:*:* Versions 12.1.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:* Versions 12.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.54:*:*:*:*:*:*:* Versions 8.54 Vulnerable ·Oracle
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*8.55VulnerableOracle
cpe:2.3:a:oracle:virtual_desktop_infrastructure:3.5.2:*:*:*:*:*:*:*3.5.2VulnerableOracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* Versions 8.55 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:virtual_desktop_infrastructure:3.5.2:*:*:*:*:*:*:* Versions 3.5.2 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-4mv7-cq75-3qjm org.bouncycastle:bcprov-jdk15 (Maven) Fixed in 1.51 Advisory →
  • Fix · GHSA-4mv7-cq75-3qjm org.bouncycastle:bcprov-jdk14 (Maven) Fixed in 1.51 Advisory →
  • Fix · GHSA-4mv7-cq75-3qjm org.bouncycastle:bcprov-jdk15on (Maven) Fixed in 1.51 Advisory →

Red Hat 2 advisories

  • RHSA-2016:2035 Released 2016-10-06 · Red Hat rating Important
    Red Hat JBoss Fuse 6.3 security update
    • Red Hat JBoss Fuse 6.3
  • RHSA-2016:2036 Released 2016-10-06 · Red Hat rating Important
    Red Hat JBoss A-MQ 6.3 security update
    • Red Hat JBoss A-MQ 6.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss A-MQ 6AffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix planned: Will not fix
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6.3Fixed RHSA-2016:2036
Red Hat JBoss Fuse 6.3Fixed RHSA-2016:2035

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-7940
  2. 2026-10-03 Alias added: GHSA-4mv7-cq75-3qjm

References

Advisory 11

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences