CVE-2015-7940

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain…

published November 9, 2015

CVSS
—
EPSS
5%
Percentile
91.9
In the wild
Unconfirmed
What it is

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04820 · 91.9th percentile
Published
2015-11-09T16:00Z
EPSS history
Timeline
  • 09 NOV 16:00Z
    The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain…
    cvelistv5