Out-of-bounds read in Dell RSA BSAFE Crypto-C Micro Edition
Priority LOW 37CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
RSA BSAFE Crypto-C Micro Edition versions from 4.0.0.0 before 4.0.5.4 and from 4.1.0 before 4.1.4, RSA BSAFE Micro Edition Suite versions from 4.0.0 before 4.0.13 and from 4.1.0 before 4.4 and RSA Crypto-C versions from 6.0.0 through 6.4.* are vulnerable to an out-of-bounds read vulnerability when processing DSA signature. A malicious remote user could potentially exploit this vulnerability to cause a crash in the library of the affected system.
Why it matters now
EPSS 0.02405 84th percentileScored 2026-11-07
Fix Fixed RSA BSAFE Crypto-C Micro Edition (Dell): 4.0.5.4, 4.1.4RSA BSAFE Micro Edition Suite (Dell): 4.0.13, 4.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | RSA BSAFE Crypto-C Micro Edition | 4.0.0.0 to before 4.0.5.4; 4.1.0 to before 4.1.4 | 4.0.5.4, 4.1.4 | Patch available | CNA |
| Dell | RSA BSAFE Micro Edition Suite | 4.0.0 to before 4.0.13; 4.1.0 to before 4.4 | 4.0.13, 4.4 | Patch available | CNA |
| Dell | RSA Crypto-C | 6.0.0 and later | — | No fix listed | CNA |
- RSA BSAFE Crypto-C Micro Edition VendorDell Affected 4.0.0.0 to before 4.0.5.4; 4.1.0 to before 4.1.4 Fixed in 4.0.5.4, 4.1.4 Patch available CNA
- RSA BSAFE Micro Edition Suite VendorDell Affected 4.0.0 to before 4.0.13; 4.1.0 to before 4.4 Fixed in 4.0.13, 4.4 Patch available CNA
- RSA Crypto-C VendorDell Affected 6.0.0 and later Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:bsafe_crypto-c:*:*:*:*:*:*:*:* | 6.0.0 – 6.4 | Vulnerable | Dell |
| cpe:2.3:a:dell:bsafe_crypto-c-micro-edition:*:*:*:*:*:*:*:* | 4.0.0 to before 4.0.5.4; 4.1.0 to before 4.1.4 | Vulnerable | Dell |
| cpe:2.3:a:dell:bsafe_micro-edition-suite:*:*:*:*:*:*:*:* | 4.0.0 to before 4.0.13; 4.1.0 to before 4.4.0 | Vulnerable | Dell |
- cpe:2.3:a:dell:bsafe_crypto-c:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.4 Vulnerable ·Dell
- cpe:2.3:a:dell:bsafe_crypto-c-micro-edition:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.0.5.4; 4.1.0 to before 4.1.4 Vulnerable ·Dell
- cpe:2.3:a:dell:bsafe_micro-edition-suite:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.0.13; 4.1.0 to before 4.4.0 Vulnerable ·Dell
Remediation
- Fix · CNA RSA BSAFE Crypto-C Micro Edition (Dell) Fixed in 4.0.5.4, 4.1.4
- Fix · CNA RSA BSAFE Micro Edition Suite (Dell) Fixed in 4.0.13, 4.4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3728
- 2026-10-03 Alias added: GHSA-g6qh-mc7h-56g2
References
More Dell Bsafe Crypto-c vulnerabilities
- TI-2018-07844 Out-of-bounds read in RSA BSAFE Micro Edition Suite CVSS 3.1CRITICAL 9.8
- TI-2015-00497 Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition… CVSS 3.1CRITICAL 9.8
- TI-2018-07842 Uncontrolled resource consumption in RSA BSAFE Micro Edition Suite CVSS 3.1MEDIUM 6.5
- TI-2006-03771 The RSA Crypto-C before 6.3.1 and Cert-C before 2.8 libraries, as used by RSA BSAFE… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2019-3728 · CVE Program
- CVE-2019-3728 · NVD
- FIRST EPSS
- GHSA-g6qh-mc7h-56g2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences