Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

GHSA-v435-xc8x-wvr9

GitHub Security Advisory

Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")

✓ GitHub Reviewed MODERATE Has CVE
View on GitHub

Advisory Details

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.

Affected Packages

Maven org.bouncycastle:bctls-fips
Affected versions: 0 (fixed in 1.0.19)
Maven org.bouncycastle:bcprov-jdk18on
Affected versions: 0 (fixed in 1.78)
Maven org.bouncycastle:bcprov-jdk15on
Affected versions: 0 (fixed in 1.78)
Maven org.bouncycastle:bcprov-jdk15to18
Affected versions: 0 (fixed in 1.78)
Maven org.bouncycastle:bcprov-jdk14
Affected versions: 0 (fixed in 1.78)
Maven org.bouncycastle:bctls-jdk18on
Affected versions: 0 (fixed in 1.78)
Maven org.bouncycastle:bctls-jdk14
Affected versions: 0 (fixed in 1.78)
Maven org.bouncycastle:bctls-jdk15to18
Affected versions: 0 (fixed in 1.78)
NuGet BouncyCastle
Affected versions: 0
NuGet BouncyCastle.Cryptography
Affected versions: 0 (fixed in 2.3.1)

Related CVEs

CVE-2024-30171

Key Information

GHSA ID
GHSA-v435-xc8x-wvr9
Published
May 14, 2024 3:32 PM
Last Modified
September 9, 2024 9:27 PM
CVSS Score
5.0 /10
Primary Ecosystem
Maven
Primary Package
org.bouncycastle:bctls-fips
GitHub Reviewed
✓ Yes

Dataset

Last updated: September 20, 2025 6:20 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.