CVE-2019-3738

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-18 · updated 2026-06-17
Weakness: CWE-325

Description

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.

Affected products

Dell Bsafe Cert-J: through 6.2.4
RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2: before 6.2.5 — fixed in 6.2.5
Dell BSAFE SSL-J: through 6.2.4.1
McAfee,LLC Threat Intelligence Exchange Server (TIE Server): from 2.0.0 through 2.3.1; 3.0.0
Oracle Corporation APM - Application Performance Management: 13.3.0.0, 13.4.0.0
Oracle Communications Network Integrity: 7.3.2, 7.3.5, 7.3.6
Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.2, 7.3.4, 7.3.5, 7.4.0, 7.4.1
Oracle Database: 12.1.0.2, 12.2.0.1, 18c, 19c
Oracle Corporation Oracle GoldenGate: before 19.1.0.0.0.210420; 19.1.0.0.0.210420 — fixed in 19.1.0.0.0.210420
Oracle Retail Assortment Planning: 15.0.3.0, 16.0.3.0
Oracle Corporation Oracle Retail Integration Bus: 14.1, 15.0, 16.0
Oracle Retail Predictive Application Server: 14.1.3.0, 15.0.3.0, 16.0.3.0
Oracle Retail Service Backbone: 14.1, 15.0, 16.0
Oracle Corporation Retail Store Inventory Management: 14.0.4, 14.1.3, 15.0.3, 16.0.3
Oracle Corporation Retail Xstore Point of Service: 15.0.3, 16.0.5, 17.0.3, 18.0.2, 19.0.1
Oracle Storagetek Tape Analytics Sw Tool: 2.3

How to fix

Upgrade to a fixed version: RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2 6.2.5; Oracle Corporation Oracle GoldenGate 19.1.0.0.0.210420. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-3738 or the next vulnerability affects your stack