CVE-2019-3740
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk90th percentile - higher than 90% of all known CVEs
Summary
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
Risk Assessment
An attacker could recover DSA keys, potentially leading to compromise of confidentiality and integrity of data signed with those keys.
Recommendation
Update RSA BSAFE Crypto-J to version 6.2.5 or later to eliminate the information exposure vulnerability.
Other vulnerabilities in RSA BSAFE Crypto-J
Original NVD description (English source)
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS