NVD Vulnerability Detail

CVE-2017-13098

Summary	BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."
Publication Date	Dec. 13, 2017, 10:29 a.m.
Registration Date	Jan. 26, 2021, 1:14 p.m.
Last Update	Nov. 21, 2024, 12:10 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api::::::::					1.59

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html
2	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html
3	http://www.kb.cert.org/vuls/id/144389	Issue Tracking Mitigation Third Party Advisory US Government Resource
4	http://www.kb.cert.org/vuls/id/144389	Issue Tracking Mitigation Third Party Advisory US Government Resource
5	http://www.securityfocus.com/bid/102195	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/102195	Third Party Advisory VDB Entry
7	https://github.com/bcgit/bc-java/commit/a00b684465b38d722ca9a3543b8af8568e6bad5c	Issue Tracking Patch Third Party Advisory
8	https://github.com/bcgit/bc-java/commit/a00b684465b38d722ca9a3543b8af8568e6bad5c	Issue Tracking Patch Third Party Advisory
9	https://robotattack.org/	Issue Tracking Third Party Advisory
10	https://robotattack.org/	Issue Tracking Third Party Advisory
11	https://security.netapp.com/advisory/ntap-20171222-0001/	Issue Tracking Third Party Advisory
12	https://security.netapp.com/advisory/ntap-20171222-0001/	Issue Tracking Third Party Advisory
13	https://www.debian.org/security/2017/dsa-4072	Issue Tracking Third Party Advisory
14	https://www.debian.org/security/2017/dsa-4072	Issue Tracking Third Party Advisory
15	https://www.oracle.com/security-alerts/cpuoct2020.html
16	https://www.oracle.com/security-alerts/cpuoct2020.html

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-203	セキュリティ関連の処理に対するレスポンスの違いに起因する情報漏えい	https://cwe.mitre.org/data/definitions/203.html

JVN Vulnerability Information

BouncyCastle TLS における暗号に関する脆弱性

Title	BouncyCastle TLS における暗号に関する脆弱性
Summary	BouncyCastle TLS には、暗号に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 12, 2017, midnight
Registration Date	Jan. 22, 2018, 2:13 p.m.
Last Update	Jan. 22, 2018, 2:13 p.m.

Affected System

Bouncy Castle

Bouncy Castle Cryptography C# API

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-13098	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13098
National Vulnerability Database (NVD)
2	CVE-2017-13098	https://nvd.nist.gov/vuln/detail/CVE-2017-13098

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-310	https://jvndb.jvn.jp/ja/cwe/CWE-310.html

ベンダー情報

No	Name	URL
GitHub
1	Confirm size of decrypted PMS before using	https://github.com/bcgit/bc-java/commit/a00b684465b38d722ca9a3543b8af8568e6bad5c
NetApp Advisory
2	NTAP-20171222-0001	https://security.netapp.com/advisory/ntap-20171222-0001/

その他

No	Name	URL
JVN
1	JVNVU#92438713	http://jvn.jp/vu/JVNVU92438713/index.html
US-CERT Vulnerability Note
2	VU#144389	http://www.kb.cert.org/vuls/id/144389

Change Log

No	Changed Details	Date of change
0	[2018年01月22日] 掲載	Feb. 17, 2018, 10:37 a.m.