CVE-2019-3739

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-18 · updated 2026-10-08
Weakness: CWE-310

Description

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.

Affected products

Dell Bsafe Cert-J: through 6.2.4
RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2: before 6.2.5 — fixed in 6.2.5
Dell BSAFE SSL-J: through 6.2.4.1
Oracle Corporation APM - Application Performance Management: 13.3.0.0, 13.4.0.0
Oracle Communications Network Integrity: 7.3.2, 7.3.5, 7.3.6
Oracle Database: 12.1.0.2, 12.2.0.1, 18c, 19c
Oracle Corporation Oracle GoldenGate: before 19.1.0.0.0.210420 — fixed in 19.1.0.0.0.210420
Oracle Retail Assortment Planning: 15.0.3.0, 16.0.3.0
Oracle Corporation Oracle Retail Integration Bus: 14.1, 15.0, 16.0
Oracle Retail Predictive Application Server: 14.1.3.0, 15.0.3.0, 16.0.3.0
Oracle Retail Service Backbone: 14.1, 15.0, 16.0
Oracle Corporation Retail Store Inventory Management: 14.0.4, 14.1.3, 15.0.3, 16.0.3
Oracle Corporation Retail Xstore Point of Service: 15.0.3, 16.0.5, 17.0.3, 18.0.2, 19.0.1
Oracle Storagetek Acsls: 8.5.1
Oracle Storagetek Tape Analytics Sw Tool: 2.3
Oracle WebLogic Server: 10.3.6.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

How to fix

Upgrade to a fixed version: RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2 6.2.5; Oracle Corporation Oracle GoldenGate 19.1.0.0.0.210420. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-3739 or the next vulnerability affects your stack