What’s Vulnerable › Vulnerabilities

CVE-2019-3740

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-18 · updated 2026-10-08
• Weakness: CWE-310

Description

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.

Affected products

• Dell Bsafe Cert-J: through 6.2.4
• RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2: before 6.2.5 — fixed in 6.2.5
• Dell BSAFE SSL-J: through 6.2.4.1
• Oracle Corporation APM - Application Performance Management: 13.3.0.0, 13.4.0.0
• Oracle Communications Network Integrity: 7.3.2, 7.3.5, 7.3.6
• Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.2, 7.3.4, 7.3.5, 7.4.0, 7.4.1
• Oracle Database: 12.1.0.2, 12.2.0.1, 18c, 19c
• Oracle Global Lifecycle Management Opatch: before 12.2.0.1.22 — fixed in 12.2.0.1.22
• Oracle Corporation Oracle GoldenGate: before 19.1.0.0.0.210420 — fixed in 19.1.0.0.0.210420
• Oracle Retail Assortment Planning: 15.0.3.0, 16.0.3.0
• Oracle Corporation Oracle Retail Integration Bus: 14.1, 15.0, 16.0
• Oracle Retail Predictive Application Server: 14.1.3.0, 15.0, 15.0.3.0, 16.0.3.0
• Oracle Retail Service Backbone: 14.1, 15.0, 16.0
• Oracle Corporation Retail Store Inventory Management: 14.0.4, 14.1.3, 15.0.3, 16.0.3
• Oracle Corporation Retail Xstore Point of Service: 15.0.3, 16.0.5, 17.0.3, 18.0.2, 19.0.1
• Oracle Storagetek Acsls: 8.5.1
• Oracle Storagetek Tape Analytics Sw Tool: 2.3
• Oracle WebLogic Server: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

How to fix

Upgrade to a fixed version: RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2 6.2.5; Oracle Global Lifecycle Management Opatch 12.2.0.1.22; Oracle Corporation Oracle GoldenGate 19.1.0.0.0.210420. Check the vendor advisory for mitigations.

References

• https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2020.html

Get alerted when CVE-2019-3740 or the next vulnerability affects your stack