The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2015-11-09T16:00:00

Updated: 2024-08-06T08:06:30.850Z

Reserved: 2015-10-22T00:00:00

Link: CVE-2015-7940

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2015-11-09T16:59:09.277

Modified: 2024-11-21T02:37:42.203

Link: CVE-2015-7940

cve-icon Redhat

Severity : Moderate

Publid Date: 2015-09-14T00:00:00Z

Links: CVE-2015-7940 - Bugzilla