VulnerabilityModified
CVE-2019-3738
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability.
MEDIUM 6.5EPSS 1.68%
Does this matter?
Lower severity and a low EPSS score (1.68%). Track it; it rarely justifies an emergency change on its own.
Description
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 1.68% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-325, CWE-347
- Affected
- dell/bsafe cert-j · dell/bsafe crypto-j · dell/bsafe ssl-j · mcafee/threat intelligence exchange server · oracle/application performance management · oracle/communications network integrity · oracle/communications unified inventory management · oracle/database · oracle/goldengate · oracle/retail assortment planning · oracle/retail integration bus · oracle/retail predictive application server · oracle/retail service backbone · oracle/retail store inventory management · oracle/retail xstore point of service · oracle/storagetek tape analytics sw tool
- Source
- security_alert@emc.com
References
- https://kc.mcafee.com/corporate/index?page=content&id=SB10318Third Party Advisory
- https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE®%3B-Crypto-J-Multiple-Security-Vulnerabilities
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10318Third Party Advisory
- https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE®%3B-Crypto-J-Multiple-Security-Vulnerabilities
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.