Observable discrepancy in Bouncy Castle for Java - CVE-2024-30171

Vulnerability identifier: #VU89219

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-30171

CWE-ID: CWE-203

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a possible timing based leakage in RSA based handshakes. A remote attacker can gain access to sensitive information.

Bouncy Castle for Java
IBM DB2
Keycloak
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
openSUSE Leap
Ubuntu
Anolis OS
Log Analysis
IBM Process Mining
IBM Cloud Transformation Advisor
IBM MQ Operator
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Spectrum Symphony
WebSphere Remote Server
Splunk AppDynamics Database Agent
Cryostat
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Observability with Instana
IBM App Connect for Manufacturing
DB2 Data Management Console
DataStage on Cloud Pak for Data
IBM OpenPages with Watson
Maximo Application Suite - Health Component
Maximo Application Suite - Visual Inspection Component
Rational Performance Tester
webMethods Managed File Transfer
DevOps Test Performance
IBM Application Suite - IBM Asset Data Dictionary Component
Storage Defender - Resiliency Service
Storage Defender Copy Data Management
Cloud Pak for Network Automation
PowerStore T
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Storage Protect Server
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Maximo Application Suite - Predict Component
IBM Event Endpoint Management
Cognos Transformer
Robotic Process Automation Client for SaaS
Robotic Process Automation for Cloud Pak
JBoss Enterprise Application Platform
Juniper Secure Analytics (JSA)
QRadar Suite
IBM Cognos Controller
IBM License Metric Tool
Event Streams
eap7-netty-xnio-transport (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
bouncycastle (Ubuntu package)
bouncycastle-util
bouncycastle-mail
bouncycastle-tls
bouncycastle-jmail
bouncycastle-pkix
bouncycastle-pg
bouncycastle-javadoc
bouncycastle
eap7-bouncycastle (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jandex (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-netty (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)
Planning Analytics Local
IBM Cloud Pak System
Red Hat Camel for Spring Boot
IBM Storage Scale System

Install updates from vendor's website.

Bouncy Castle for Java - update to 1.78
Keycloak - update to 25.0.0
Log Analysis - update to 1.3.8.2
IBM Process Mining - update to 1.15.0
IBM Cloud Transformation Advisor - update to 3.10.2
IBM MQ Operator - addressed in versions 9.3.0.20-r1, 9.4.0.0-r2
DB2 Data Management Console - update to 3.1.13.2
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
DataStage on Cloud Pak for Data - update to 5.2.1
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
JBoss Enterprise Application Platform - update to 7.4.18
IBM Spectrum Symphony - update to 7.3.2 FP3
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
Maximo Application Suite - Visual Inspection Component - update to 9.0.3
DevOps Test Performance - update to 11.0.7
IBM Cognos Controller - update to 11.0.1.0.3
Splunk AppDynamics Database Agent - update to 26.1.0
eap7-netty-xnio-transport (Red Hat package) - addressed in versions 0.1.10-1.Final_redhat_00001.1.el7eap, 0.1.10-1.Final_redhat_00001.1.el8eap, 0.1.10-1.Final_redhat_00001.1.el9eap
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
eap7-log4j-jboss-logmanager (Red Hat package) - addressed in versions 1.3.1-1.Final_redhat_00002.1.el7eap, 1.3.1-1.Final_redhat_00002.1.el8eap, 1.3.1-1.Final_redhat_00002.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.17-1.Final_redhat_00001.1.el7eap, 1.5.17-1.Final_redhat_00001.1.el8eap, 1.5.17-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-37.Final_redhat_00037.1.el7eap, 1.10.0-37.Final_redhat_00037.1.el8eap, 1.10.0-37.Final_redhat_00037.1.el9eap
QRadar Suite - update to 1.10.22.0
bouncycastle (Ubuntu package) - addressed in versions 1.51-4ubuntu1+esm1, 1.59-1ubuntu0.1~esm1, 1.61-1ubuntu0.1~esm1, 1.68-5ubuntu0.1~esm1, 1.77-1ubuntu0.1~esm1
bouncycastle-util - update to 1.77-1
bouncycastle-mail - update to 1.77-1
bouncycastle-tls - update to 1.77-1
bouncycastle-jmail - update to 1.77-1
bouncycastle-pkix - update to 1.77-1
bouncycastle-pg - update to 1.77-1
bouncycastle-javadoc - update to 1.77-1
bouncycastle - update to 1.77-1
eap7-bouncycastle (Red Hat package) - addressed in versions 1.78.1-1.redhat_00002.1.el7eap, 1.78.1-1.redhat_00002.1.el8eap, 1.78.1-1.redhat_00002.1.el9eap
bouncycastle-tls - update to 1.78.1-150200.3.29.1
bouncycastle-javadoc - update to 1.78.1-150200.3.29.1
bouncycastle-pkix - update to 1.78.1-150200.3.29.1
bouncycastle-util - update to 1.78.1-150200.3.29.1
bouncycastle-pg - update to 1.78.1-150200.3.29.1
bouncycastle - update to 1.78.1-150200.3.29.1
bouncycastle-jmail - update to 1.78.1-150200.3.29.1
bouncycastle-mail - update to 1.78.1-150200.3.29.1
Planning Analytics Local - addressed in versions 2.0.0.99, 2.1.6
Storage Defender - Resiliency Service - update to 2.0.9
Storage Defender Copy Data Management - update to 2.2.28.0
eap7-undertow (Red Hat package) - addressed in versions 2.2.33-1.SP1_redhat_00001.1.el7eap, 2.2.33-1.SP1_redhat_00001.1.el8eap, 2.2.33-1.SP1_redhat_00001.1.el9eap
IBM Cloud Pak System - update to 2.3.4.1
eap7-jandex (Red Hat package) - addressed in versions 2.4.5-1.Final_redhat_00001.1.el7eap, 2.4.5-1.Final_redhat_00001.1.el8eap, 2.4.5-1.Final_redhat_00001.1.el9eap
Cloud Pak for Network Automation - update to 2.7.5
Cryostat - update to 3.0.0
eap7-hal-console (Red Hat package) - addressed in versions 3.3.23-1.Final_redhat_00001.1.el7eap, 3.3.23-1.Final_redhat_00001.1.el8eap, 3.3.23-1.Final_redhat_00001.1.el9eap
PowerStore T - update to 3.6.1.4-2413340
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.16-1.Final_redhat_00001.1.el7eap, 3.8.16-1.Final_redhat_00001.1.el8eap, 3.8.16-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.108-1.Final_redhat_00001.1.el7eap, 4.1.108-1.Final_redhat_00001.1.el8eap, 4.1.108-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.108-1.Final_redhat_00001.1.el7eap, 4.1.108-1.Final_redhat_00001.1.el8eap, 4.1.108-1.Final_redhat_00001.1.el9eap
Red Hat Camel for Spring Boot - update to 4.4.0
IBM Cloud Pak for Watson AIOps - update to 4.8.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.1
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.29-1.Final_redhat_00001.1.el7eap, 5.0.29-1.Final_redhat_00001.1.el8eap, 5.0.29-1.Final_redhat_00001.1.el9eap
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
IBM Storage Scale System - addressed in versions 5.1.9.5, 5.2.1.0
eap7-wildfly (Red Hat package) - addressed in versions 7.4.18-1.GA_redhat_00001.1.el7eap, 7.4.18-1.GA_redhat_00001.1.el8eap, 7.4.18-1.GA_redhat_00001.1.el9eap
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.25
Maximo Application Suite - IoT Component - addressed in versions 8.7.19, 8.8.15, 9.0.5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.10, 8.11.7
IBM Maximo Application Suite - addressed in versions 8.10.19, 8.11.16, 9.0.4
Maximo Application Suite - Predict Component - update to 9.0.0
IBM License Metric Tool - update to 9.2.36
IBM Security Verify Governance - update to 10.0.2.0.4
IBM Event Endpoint Management - update to 11.2.1
Cognos Transformer - addressed in versions 11.2.4 FP5, 12.0.4
Event Streams - update to 11.5.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Robotic Process Automation Client for SaaS - update to 21.0.7.18
IBM Robotic Process Automation - update to 21.0.7.18
Robotic Process Automation for Cloud Pak - update to 21.0.7.18
IBM Observability with Instana - update to 273

• https://www.bouncycastle.org/releasenotes.html#1.78

• Multiple vulnerabilities in Bouncy Castle Crypto Package For Java
• SUSE update for bouncycastle
• Multiple vulnerabilities in Keycloak
• Multiple vulnerabilities in IBM Instana Observability
• SUSE update for bouncycastle
• Multiple vulnerabilities in IBM License Metric Tool
• Observable discrepancy in IBM Process Mining
• Observable discrepancy in IBM Maximo Application Suite - Predict Component
• Red Hat build of Cryostat update for the Bouncy Castle Crypto Package For Java
• Multiple vulnerabilities in IBM App Connect for Manufacturing
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
• Observable discrepancy in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Event Endpoint Management
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Observable discrepancy in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 
• Multiple vulnerabilities in IBM Storage Scale
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Multiple vulnerabilities in IBM Robotic Process Automation
• Multiple vulnerabilities in IBM Maximo Application Suite - Visual Inspection Component
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in IBM OpenPages with Watson
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• IBM Sterling B2B Integrator update for Bouncy Castle
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Planning Analytics
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Storage Protect Server
• IBM Cognos Transformer update for Bouncy Castle
• Multiple vulnerabilities in Dell PowerStore T
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Asset Data Dictionary Component
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Bouncy Castle Crypto Package For Java
• IBM Maximo Application Suite - Health Component update for Bouncy Castle Crypto Package For Java
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Anolis OS update for bouncycastle
• Anolis OS update for bouncycastle
• Anolis OS update for bouncycastle
• Anolis OS update for bouncycastle
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Storage Defender Copy Data Management
• Multiple vulnerabilities in IBM Rational Performance Tester
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Splunk AppDynamics Database Agent update for third-party components
• Ubuntu update for bouncycastle