Read the docs
TI-2019-02758 Aliases CVE-2019-3739GHSA-p9w8-99j3-73rv

Cryptographic flaw in Dell RSA BSAFE Crypto-J

Priority LOW 34CWE-310Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-203.

Summary

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0263 85th percentileScored 2026-11-07
Fix Fixed RSA BSAFE Crypto-J (Dell): 6.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellRSA BSAFE Crypto-Jbefore 6.2.56.2.5Patch availableCNA
  • RSA BSAFE Crypto-J VendorDell Affected before 6.2.5 Fixed in 6.2.5 Patch available CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:dell:bsafe_cert-j:*:*:*:*:*:*:*:*up to 6.2.4VulnerableDell
cpe:2.3:a:dell:bsafe_crypto-j:*:*:*:*:*:*:*:*before 6.2.5VulnerableDell
cpe:2.3:a:dell:bsafe_ssl-j:*:*:*:*:*:*:*:*up to 6.2.4.1VulnerableDell
cpe:2.3:a:oracle:application_performance_management:13.3.0.0:*:*:*:*:*:*:*13.3.0.0VulnerableOracle
cpe:2.3:a:oracle:application_performance_management:13.4.0.0:*:*:*:*:*:*:*13.4.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_network_integrity:7.3.2:*:*:*:*:*:*:*7.3.2VulnerableOracle
cpe:2.3:a:oracle:communications_network_integrity:7.3.5:*:*:*:*:*:*:*7.3.5VulnerableOracle
cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*7.3.6VulnerableOracle
cpe:2.3:a:oracle:database:12.1.0.2:*:*:*:enterprise:*:*:*12.1.0.2VulnerableOracle
cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:enterprise:*:*:*12.2.0.1VulnerableOracle
  • cpe:2.3:a:dell:bsafe_cert-j:*:*:*:*:*:*:*:* Versions up to 6.2.4 Vulnerable ·Dell
  • cpe:2.3:a:dell:bsafe_crypto-j:*:*:*:*:*:*:*:* Versions before 6.2.5 Vulnerable ·Dell
  • cpe:2.3:a:dell:bsafe_ssl-j:*:*:*:*:*:*:*:* Versions up to 6.2.4.1 Vulnerable ·Dell
  • cpe:2.3:a:oracle:application_performance_management:13.3.0.0:*:*:*:*:*:*:* Versions 13.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_performance_management:13.4.0.0:*:*:*:*:*:*:* Versions 13.4.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_network_integrity:7.3.2:*:*:*:*:*:*:* Versions 7.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_network_integrity:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:* Versions 7.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database:12.1.0.2:*:*:*:enterprise:*:*:* Versions 12.1.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:enterprise:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:database:18c:*:*:*:enterprise:*:*:*18cVulnerableOracle
cpe:2.3:a:oracle:database:19c:*:*:*:enterprise:*:*:*19cVulnerableOracle
cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*before 19.1.0.0.0.210420VulnerableOracle
cpe:2.3:a:oracle:retail_assortment_planning:15.0.3.0:*:*:*:*:*:*:*15.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_assortment_planning:16.0.3.0:*:*:*:*:*:*:*16.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3.0:*:*:*:*:*:*:*14.1.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3.0:*:*:*:*:*:*:*15.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:*16.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:*14.1VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4:*:*:*:*:*:*:*14.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3:*:*:*:*:*:*:*14.1.3VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.5:*:*:*:*:*:*:*16.0.5VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.3:*:*:*:*:*:*:*17.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.2:*:*:*:*:*:*:*18.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.1:*:*:*:*:*:*:*19.0.1VulnerableOracle
cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*8.5.1VulnerableOracle
cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:*2.3VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*10.3.6.0.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
  • cpe:2.3:a:oracle:database:18c:*:*:*:enterprise:*:*:* Versions 18c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:database:19c:*:*:*:enterprise:*:*:* Versions 19c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:* Versions before 19.1.0.0.0.210420 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_assortment_planning:15.0.3.0:*:*:*:*:*:*:* Versions 15.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_assortment_planning:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3.0:*:*:*:*:*:*:* Versions 14.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3.0:*:*:*:*:*:*:* Versions 15.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4:*:*:*:*:*:*:* Versions 14.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3:*:*:*:*:*:*:* Versions 14.1.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.5:*:*:*:*:*:*:* Versions 16.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.3:*:*:*:*:*:*:* Versions 17.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.2:*:*:*:*:*:*:* Versions 18.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* Versions 10.3.6.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA RSA BSAFE Crypto-J (Dell) Fixed in 6.2.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3739
  2. 2026-10-03 Alias added: GHSA-p9w8-99j3-73rv
  3. 2026-10-08 CISA SSVC decision points changed

References

Patch 6

Other 1

  • TI-2019-02759 Cryptographic flaw in Dell RSA BSAFE Crypto-J CVSS 3.1MEDIUM 6.5
  • TI-2019-02757 Improper signature verification in Dell RSA BSAFE Crypto-J CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences