CVE-2019-3732

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-30 · updated 2026-06-17
Weakness: CWE-385

Description

RSA BSAFE Crypto-C Micro Edition, versions prior to 4.0.5.3 (in 4.0.x) and versions prior to 4.1.3.3 (in 4.1.x), and RSA Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) versions prior to 4.1.6.1 (in 4.1.x) and versions prior to 4.3.3 (4.2.x and 4.3.x) are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure.

Affected products

Dell Bsafe Crypto-C-Micro-Edition: from 4.0 before 4.0.5.3 — fixed in 4.0.5.3
Dell RSA BSAFE MES: from 4.0.0 before 4.0.11; from 4.1.0 before 4.1.6.1; from 4.2.0 before 4.3.3 — fixed in 4.0.11, 4.1.6.1, 4.3.3
EMC Rsa Bsafe Crypto-C: from 4.1 before 4.1.3.3 — fixed in 4.1.3.3

How to fix

Upgrade to a fixed version: Dell Bsafe Crypto-C-Micro-Edition 4.0.5.3; Dell RSA BSAFE MES 4.0.11, 4.1.6.1, 4.3.3; EMC Rsa Bsafe Crypto-C 4.1.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-3732 or the next vulnerability affects your stack