Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA     before 1.0.1.1 have a timing issue within the EC math library that can expose information about the     private key when an attacker is able to observe timing information for the generation of multiple     deterministic ECDSA signatures. (CVE-2020-15522)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Bouncy Castle team reports: :

Bouncy Castle BC Java before 1.66 has a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2163-1 advisory.

  - Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA     before 1.0.1.1 have a timing issue within the EC math library that can expose information about the     private key when an attacker is able to observe timing information for the generation of multiple     deterministic ECDSA signatures. (CVE-2020-15522)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:0940-1 advisory.

  - Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA     before 1.0.1.1 have a timing issue within the EC math library that can expose information about the     private key when an attacker is able to observe timing information for the generation of multiple     deterministic ECDSA signatures. (CVE-2020-15522)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2163-1 advisory.

  - Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA     before 1.0.1.1 have a timing issue within the EC math library that can expose information about the     private key when an attacker is able to observe timing information for the generation of multiple     deterministic ECDSA signatures. (CVE-2020-15522)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250918	Linux Distros Unpatched Vulnerability : CVE-2020-15522	Nessus	Misc.	medium
152747	FreeBSD : bouncycastle15 -- EC math vulnerability (89d5bca6-0150-11ec-bf0c-080027eedc6a)	Nessus	FreeBSD Local Security Checks	medium
151703	openSUSE 15 Security Update : bouncycastle (openSUSE-SU-2021:2163-1)	Nessus	SuSE Local Security Checks	medium
151199	openSUSE 15 Security Update : bouncycastle (openSUSE-SU-2021:0940-1)	Nessus	SuSE Local Security Checks	medium
151100	SUSE SLED15 / SLES15 Security Update : bouncycastle (SUSE-SU-2021:2163-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-15522

medium

Tenable Plugins

medium

medium

medium

medium

medium