CVE-2007-6721

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-03-30 · updated 2026-06-16

Description

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."

Affected products

Legion of the Bouncy Castle Inc. BC-JAVA: through 1.37; 1.01, 1.02, 1.03, 1.04, 1.05, 1.06 (+30)
Bouncycastle Bouncy-Castle-Crypto-Package: through 1.35; 1.0, 1.01, 1.02, 1.03, 1.3.1, 1.04 (+28)

References

http://freshmeat.net/projects/bouncycastlecryptoapi/releases/265580
http://www.bouncycastle.org/csharp/
http://www.bouncycastle.org/devmailarchive/msg08195.html
http://www.bouncycastle.org/releasenotes.html
http://www.osvdb.org/50358
http://www.osvdb.org/50359
http://www.osvdb.org/50360
http://freshmeat.net/projects/bouncycastlecryptoapi/releases/265580
http://www.bouncycastle.org/csharp/
http://www.bouncycastle.org/devmailarchive/msg08195.html
http://www.bouncycastle.org/releasenotes.html
http://www.osvdb.org/50358

Get alerted when CVE-2007-6721 or the next vulnerability affects your stack