Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016627 advisory.

    Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA     before 1.0.1.1 have a timing issue within the EC math library that can expose information about the     private key when an attacker is able to observe timing information for the generation of multiple     deterministic ECDSA signatures.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA     before 1.0.1.1 have a timing issue within the EC math library that can expose information about the     private key when an attacker is able to observe timing information for the generation of multiple     deterministic ECDSA signatures. (CVE-2020-15522)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA
    before 1.0.1.1 have a timing issue within the EC math library that can expose information about the
    private key when an attacker is able to observe timing information for the generation of multiple
    deterministic ECDSA signatures. (CVE-2020-15522)

The Bouncy Castle team reports: :

Bouncy Castle BC Java before 1.66 has a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2163-1 advisory.

  - Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA     before 1.0.1.1 have a timing issue within the EC math library that can expose information about the     private key when an attacker is able to observe timing information for the generation of multiple     deterministic ECDSA signatures. (CVE-2020-15522)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:0940-1 advisory.

  - Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA     before 1.0.1.1 have a timing issue within the EC math library that can expose information about the     private key when an attacker is able to observe timing information for the generation of multiple     deterministic ECDSA signatures. (CVE-2020-15522)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2163-1 advisory.

    - CVE-2020-15522: Fixed a timing issue within the EC math library (bsc#1186328).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
316191	Unity Linux 20.1060e / 20.1070e Security Update: bouncycastle (UTSA-2026-016627)	Nessus	Unity Linux Local Security Checks	medium
250918	Linux Distros Unpatched Vulnerability : CVE-2020-15522	Nessus	Misc.	medium
411720	SCA: security update for BouncyCastle, org.bouncycastle:bc-fips, org.bouncycastle:bcprov-ext-jdk15on, org.bouncycastle:bcprov-ext-jdk16, org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15, org.bouncycastle:bcprov-jdk15on, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk16 (GHSA-6xx3-rg99-gc3p)	Tenable Cloud Security	SCA Checks	medium
411720	SCA: security update for BouncyCastle, org.bouncycastle:bc-fips, org.bouncycastle:bcprov-ext-jdk15on, org.bouncycastle:bcprov-ext-jdk16, org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15, org.bouncycastle:bcprov-jdk15on, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk16 (GHSA-6xx3-rg99-gc3p)	Tenable Self-Hosted Container Security	SCA Checks	medium
152747	FreeBSD : bouncycastle15 -- EC math vulnerability (89d5bca6-0150-11ec-bf0c-080027eedc6a)	Nessus	FreeBSD Local Security Checks	medium
151703	openSUSE 15 Security Update : bouncycastle (openSUSE-SU-2021:2163-1)	Nessus	SuSE Local Security Checks	medium
151199	openSUSE 15 Security Update : bouncycastle (openSUSE-SU-2021:0940-1)	Nessus	SuSE Local Security Checks	medium
151100	SUSE SLED15 / SLES15 Security Update : bouncycastle (SUSE-SU-2021:2163-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-15522

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium