CVE-2019-3739

MediumCVSS 6.5

Published: 18/09/2019(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.54%

85th percentile - higher than 85% of all known CVEs

Summary

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy during ECDSA key generation. A malicious remote attacker could potentially exploit these vulnerabilities to recover ECDSA keys.

Risk Assessment

Exposure of ECDSA keys could compromise data confidentiality and integrity, allowing attackers to impersonate legitimate entities or decrypt communications.

Recommendation

Upgrade RSA BSAFE Crypto-J to version 6.2.5 or later immediately to mitigate the risk of key recovery.

Other vulnerabilities in RSA BSAFE Crypto-J

CVE-2019-3740Medium
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.

Original NVD description (English source)

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS