DSA-2019-094: RSA BSAFE Crypto-J Multiple Security Vulnerabilities

Résumé: RSA BSAFE Crypto-J contains fixes for multiple security vulnerabilities that could potentially be exploited by malicious users to compromise the affected system.

Cet article concerne Cet article ne concerne pas Cet article n’est associé à aucun produit spécifique. Toutes les versions du produit ne sont pas identifiées dans cet article.
Consulter d’autres ressources

Impact

Medium

Détails

  • Missing Required Cryptographic Step – CVE-2019-3738
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
 
CVSSv3 Base Score: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) – Medium
 
  • Information Exposure Through Timing Discrepancy – CVE-2019-3739
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
 
CVSSv3 Base Score: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) – Medium
 
  • Information Exposure Through Timing Discrepancy – CVE-2019-3740
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
 
CVSSv3 Base Score: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) – Medium
  • Missing Required Cryptographic Step – CVE-2019-3738
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
 
CVSSv3 Base Score: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) – Medium
 
  • Information Exposure Through Timing Discrepancy – CVE-2019-3739
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
 
CVSSv3 Base Score: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) – Medium
 
  • Information Exposure Through Timing Discrepancy – CVE-2019-3740
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
 
CVSSv3 Base Score: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) – Medium
Dell Technologies recommande à tous les clients de prendre en compte à la fois le score de base CVSS et les scores temporels et environnementaux pertinents qui peuvent avoir un impact sur la gravité potentielle associée à une faille de sécurité donnée.

Produits concernés et mesure corrective

Affected Products

  • RSA BSAFE Crypto-J versions prior to 6.2.5
  • RSA BSAFE SSL-J, all currently supported versions where 6.2.4.1 is the most recent release as of this advisory
  • RSA BSAFE Cert-J, all currently supported versions where 6.2.4 is the most recent release as of this advisory

Remediation


The following RSA BSAFE Crypto-J release contains resolutions to these vulnerabilities:
  • RSA BSAFE Crypto-J 6.2.5mo 
RSA recommends all customers upgrade Crypto-J at the earliest opportunity.
 
As RSA BSAFE SSL-J uses Crypto-J for all cryptographic operations, RSA recommends all customers to upgrade to BSAFE SSL-J 6.2.4.x which supports using Crypto-J 6.2.5. Future releases of SSL-J 6.2.4.x will include Crypto-J 6.2.5.
 
As RSA BSAFE Cert-J uses Crypto-J for all cryptographic operations, RSA recommends all customers to upgrade to BSAFE Cert-J 6.2.4 which supports using Crypto-J 6.2.5. Future releases of Cert-J will include Crypto-J 6.2.5.

 

For additional documentation, downloads and more, visit the RSA BSAFE page on RSA Link.

Affected Products

  • RSA BSAFE Crypto-J versions prior to 6.2.5
  • RSA BSAFE SSL-J, all currently supported versions where 6.2.4.1 is the most recent release as of this advisory
  • RSA BSAFE Cert-J, all currently supported versions where 6.2.4 is the most recent release as of this advisory

Remediation


The following RSA BSAFE Crypto-J release contains resolutions to these vulnerabilities:
  • RSA BSAFE Crypto-J 6.2.5mo 
RSA recommends all customers upgrade Crypto-J at the earliest opportunity.
 
As RSA BSAFE SSL-J uses Crypto-J for all cryptographic operations, RSA recommends all customers to upgrade to BSAFE SSL-J 6.2.4.x which supports using Crypto-J 6.2.5. Future releases of SSL-J 6.2.4.x will include Crypto-J 6.2.5.
 
As RSA BSAFE Cert-J uses Crypto-J for all cryptographic operations, RSA recommends all customers to upgrade to BSAFE Cert-J 6.2.4 which supports using Crypto-J 6.2.5. Future releases of Cert-J will include Crypto-J 6.2.5.

 

For additional documentation, downloads and more, visit the RSA BSAFE page on RSA Link.

Remerciements

RSA would like to thank Antonio Sanso for reporting CVE -2019-3739 and CVE-2019-3740.

Informations connexes

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Mention légale

Produits concernés

BSAFE Crypto-J, Product Security Information
Propriétés de l’article
Numéro d’article: 000180998
Type d’article: Dell Security Advisory
Dernière modification: 18 Sep 2025
Trouvez des réponses à vos questions auprès d’autres utilisateurs Dell
Services de support
Vérifiez si votre appareil est couvert par les services de support.