Observable discrepancy in Bouncy Castle for Java - CVE-2024-30171

Vulnerability identifier: #VU89219

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2024-30171

CWE-ID: CWE-203

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Bouncy Castle for Java
IBM DB2
Keycloak
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
openSUSE Leap
Ubuntu
Anolis OS
Log Analysis
IBM Process Mining
IBM Cloud Transformation Advisor
IBM MQ Operator
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Spectrum Symphony
WebSphere Remote Server
Splunk AppDynamics Database Agent
Cryostat
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Observability with Instana
IBM App Connect for Manufacturing
DB2 Data Management Console
DataStage on Cloud Pak for Data
IBM OpenPages with Watson
Maximo Application Suite - Health Component
Maximo Application Suite - Visual Inspection Component
Rational Performance Tester
webMethods Managed File Transfer
DevOps Test Performance
IBM Application Suite - IBM Asset Data Dictionary Component
Storage Defender - Resiliency Service
Storage Defender Copy Data Management
Cloud Pak for Network Automation
PowerStore T
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Storage Protect Server
Maximo Application Suite - IoT Component
Maximo Application Suite - Monitor Component
Maximo Application Suite - Predict Component
IBM Event Endpoint Management
Cognos Transformer
Robotic Process Automation Client for SaaS
Robotic Process Automation for Cloud Pak
JBoss Enterprise Application Platform
Juniper Secure Analytics (JSA)
QRadar Suite
IBM Cognos Controller
IBM License Metric Tool
Event Streams
eap7-netty-xnio-transport (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
bouncycastle (Ubuntu package)
bouncycastle-util
bouncycastle-mail
bouncycastle-tls
bouncycastle-jmail
bouncycastle-pkix
bouncycastle-pg
bouncycastle-javadoc
bouncycastle
eap7-bouncycastle (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jandex (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-netty (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)
Planning Analytics Local
IBM Cloud Pak System
Red Hat Camel for Spring Boot
IBM Storage Scale System

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a possible timing based leakage in RSA based handshakes. A remote attacker can gain access to sensitive information.

Install updates from vendor's website.

• https://www.bouncycastle.org/releasenotes.html#1.78