Skip to content
OpenAdvisories
Medium · 5.9 CVE-2024-30171 EUVD-2024-1786GHSA-v435-xc8x-wvr9

Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")

Published May 9, 2024 · Updated Aug 19, 2024 · Assigned by mitre

Package: bouncycastle Package: bouncycastle Package: BouncyCastle Package: BouncyCastle.Cryptography Package: druid Package: gradle-8 Package: gradle-stage0 Package: jruby-9.4 Package: jruby-9.4-default-ruby Package: opensearch-2 Package: org.bouncycastle:bcprov-jdk14 Package: org.bouncycastle:bcprov-jdk15on Package: org.bouncycastle:bcprov-jdk15to18 Package: org.bouncycastle:bcprov-jdk18on Package: org.bouncycastle:bctls-fips Package: org.bouncycastle:bctls-jdk14 Package: org.bouncycastle:bctls-jdk15to18 Package: org.bouncycastle:bctls-jdk18on Package: ruby3.2-bouncy-castle-java Package: ruby3.3-bouncy-castle-java Package: sonarqube-10 Package: tez Ecosystem: Debian Ecosystem: Maven Ecosystem: NuGet Ecosystem: Ubuntu Ecosystem: Wolfi

Description

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 bouncycastle 1.80-1 —
Debian 13 bouncycastle 1.80-1 —
Debian 12 bouncycastle No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS bouncycastle 1.77-1ubuntu0.1~esm1 —
Ubuntu Pro 22.04 LTS bouncycastle 1.68-5ubuntu0.1~esm1 —
Ubuntu Pro 20.04 LTS bouncycastle 1.61-1ubuntu0.1~esm1 —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS bouncycastle 1.59-1ubuntu0.1~esm1 —
Ubuntu Pro 16.04 LTS bouncycastle No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.21.0-5.redhat_00052.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-angus +1 2.0.3-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-angus-activation 2.0.1-3.redhat_00006.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-beanutils 1.9.4-13.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-cli 1.4.0-2.redhat_00003.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-codec 1.15.0-6.redhat_00016.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.0.4-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-mime4j +2 0.8.11-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-sshd 2.12.1-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.78.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-byte-buddy 1.14.18-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-caffeine 3.1.8-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-cxf-xjc-dv +5 4.0.0-5.redhat_00003.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.3.0-2.GA_redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-guava +1 33.0.0-1.jre_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-guava-failureaccess 1.0.2-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-hal-console 3.6.19-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-hornetq +3 2.4.9-4.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-3.redhat_00005.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-client 4.5.14-4.redhat_00012.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-core 4.4.16-4.redhat_00010.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-infinispan +20 14.0.30-2.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-mail +1 2.1.3-1.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-servlet-api 6.0.0-5.redhat_00006.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-websocket +2 2.1.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jandex 3.0.8-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jasypt 1.9.3-4.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-java-classmate 1.5.1-3.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jaxb +9 4.0.5-2.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jboss-metadata +5 16.0.0-3.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jboss-openjdk-orb 10.1.0-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.1.0-1.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-joda-time 2.12.7-1.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jsf-impl 4.0.7-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-mod_cluster 2.0.3-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-neethi 3.2.0-1.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-netty +14 4.1.108-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-netty-xnio-transport 0.1.10-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-opensaml +13 4.2.0-4.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-parsson 1.1.5-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-reactivex-rxjava 3.1.8-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-resteasy +15 6.2.7-2.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.13-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-stax2-api 4.2.2-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-velocity +1 2.3.0-3.redhat_00009.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-weld-ejb +6 5.1.2-2.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly +3 8.0.3-9.GA_redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly-discovery +1 1.3.0-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.2.6-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wsdl4j 1.6.3-5.redhat_00008.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wss4j +6 3.0.3-1.redhat_00008.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-xml-security 3.0.4-1.redhat_00005.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-yasson 3.0.3-3.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 7 eap7-bouncycastle +5 1.78.1-1.redhat_00002.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-hal-console 3.3.23-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.17-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jandex 2.4.5-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.29-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-37.Final_redhat_00037.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.8.16-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-log4j-jboss-logmanager 1.3.1-1.Final_redhat_00002.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-netty +28 4.1.108-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-netty-xnio-transport 0.1.10-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-undertow 2.2.33-1.SP1_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.18-1.GA_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.18-1.GA_redhat_00001.1.el8eap RHSA-2024:5145, RHSA-2024:5144

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-2
SLES 15 SP5 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1
SLES 15 SP4 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1
SLES 15 SP3 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1
SLES 15 SP2 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1
SLES for SAP 15 SP3 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1
SLES for SAP 15 SP2 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1
SLE HPC 15 SP4 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1
SLE HPC 15 SP3 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1
SLE HPC 15 SP2 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1
SUSE Enterprise Storage 7.1 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bouncycastle 1.78.1-1.1 openSUSE-SU-2024:13914-1
openSUSE Leap 15.6 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-2
openSUSE Leap 15.5 bouncycastle 1.78.1-150200.3.29.1 SUSE-SU-2024:1539-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling druid 37.0.0-r8 —
Wolfi rolling gradle-8 8.7.0-r4 —
Wolfi rolling gradle-stage0 No fix yet —
Wolfi rolling jruby-9.4 +1 9.4.8.0-r0 —
Wolfi rolling opensearch-2 2.16.0-r0 —
Wolfi rolling ruby3.2-bouncy-castle-java 1.5.0146.1-r4 —
Wolfi rolling ruby3.3-bouncy-castle-java 1.5.0146.1-r1 —
Wolfi rolling sonarqube-10 25.3.0.104237-r0 —
Wolfi rolling tez 0.10.4-r6 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.bouncycastle:bcprov-jdk14 < 1.78 1.78 GHSA-v435-xc8x-wvr9
Maven org.bouncycastle:bcprov-jdk15on < 1.78 1.78 GHSA-v435-xc8x-wvr9
Maven org.bouncycastle:bcprov-jdk15to18 < 1.78 1.78 GHSA-v435-xc8x-wvr9
Maven org.bouncycastle:bcprov-jdk18on < 1.78 1.78 GHSA-v435-xc8x-wvr9
Maven org.bouncycastle:bctls-fips < 1.0.19 1.0.19 GHSA-v435-xc8x-wvr9
Maven org.bouncycastle:bctls-jdk14 < 1.78 1.78 GHSA-v435-xc8x-wvr9
Maven org.bouncycastle:bctls-jdk15to18 < 1.78 1.78 GHSA-v435-xc8x-wvr9
Maven org.bouncycastle:bctls-jdk18on < 1.78 1.78 GHSA-v435-xc8x-wvr9
NuGet BouncyCastle all versions — GHSA-v435-xc8x-wvr9
NuGet BouncyCastle.Cryptography < 2.3.1 2.3.1 GHSA-v435-xc8x-wvr9

Advisories 14

References