CVE-2020-15522
Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
- Affected products
- Bouncy Castle Bc C# .Net, Bouncy Castle Bc Java, Bouncy Castle Bc-Fja, Suse
- Bouncycastle Bc-csharp
- < 1.8.7
- Bouncycastle Bouncy Castle Fips .net Api
- < 1.0.1.1
- Bouncycastle Fips Java Api
- < 1.0.1.2, 1.0.2.1
- Bouncycastle The Bouncy Castle Crypto Package For Java
- < 1.66
- Fix
- Available
- CVSS 3.1
- 5.9 MEDIUM
- EPSS
- 1.5% (73th percentile)
- Weakness
- CWE-362
- NVD status
- Modified
- Published
- 2021-05-20
CVE-2020-15522 at NVD
No indexed exploits for CVE-2020-15522 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2020-15522 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.