{"id":"CVE-2019-3740","title":"RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation","summary":"RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to rec…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cwe":["CWE-310","CWE-203"],"vendor":"dell","product":"bsafe_cert-j","affected":["bsafe_cert-j <= 6.2.4","bsafe_crypto-j < 6.2.5","bsafe_ssl-j <= 6.2.4.1","application_performance_management = 13.3.0.0","application_performance_management = 13.4.0.0","communications_network_integrity = 7.3.2","communications_network_integrity = 7.3.5","communications_network_integrity = 7.3.6","communications_unified_inventory_management = 7.3.2","communications_unified_inventory_management = 7.3.4","communications_unified_inventory_management = 7.3.5","communications_unified_inventory_management = 7.4.0","communications_unified_inventory_management = 7.4.1","database = 12.1.0.2","database = 12.2.0.1","database = 18c","database = 19c","global_lifecycle_management_opatch < 12.2.0.1.22","goldengate < 19.1.0.0.0.210420","retail_assortment_planning = 15.0.3.0","retail_assortment_planning = 16.0.3.0","retail_integration_bus = 14.1","retail_integration_bus = 15.0","retail_integration_bus = 16.0","retail_predictive_application_server = 14.1.3.0","retail_predictive_application_server = 15.0","retail_predictive_application_server = 15.0.3.0","retail_predictive_application_server = 16.0.3.0","retail_service_backbone = 14.1","retail_service_backbone = 15.0","retail_service_backbone = 16.0","retail_store_inventory_management = 14.0.4","retail_store_inventory_management = 14.1.3","retail_store_inventory_management = 15.0.3","retail_store_inventory_management = 16.0.3","retail_xstore_point_of_service = 15.0.3","retail_xstore_point_of_service = 16.0.5","retail_xstore_point_of_service = 17.0.3","retail_xstore_point_of_service = 18.0.2","retail_xstore_point_of_service = 19.0.1","storagetek_acsls = 8.5.1","storagetek_tape_analytics_sw_tool = 2.3","weblogic_server = 10.3.6.0.0","weblogic_server = 12.1.3.0.0","weblogic_server = 12.2.1.3.0","weblogic_server = 12.2.1.4.0","weblogic_server = 14.1.1.0.0"],"patched":["bsafe_crypto-j 6.2.5","global_lifecycle_management_opatch 12.2.0.1.22","goldengate 19.1.0.0.0.210420"],"published":"2019-09-18","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:16:54.987","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-3740","references":[{"url":"https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities","label":"security_alert@emc.com"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"security_alert@emc.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"security_alert@emc.com"},{"url":"https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.03753,"epssPercentile":0.89594,"ingestedAt":"2026-10-08T23:16:47.299Z","slug":"CVE-2019-3740","body":"## Overview\n\nRSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.\n\n## Affected\n\n- `bsafe_cert-j <= 6.2.4`\n- `bsafe_crypto-j < 6.2.5`\n- `bsafe_ssl-j <= 6.2.4.1`\n- `application_performance_management = 13.3.0.0`\n- `application_performance_management = 13.4.0.0`\n- `communications_network_integrity = 7.3.2`\n- `communications_network_integrity = 7.3.5`\n- `communications_network_integrity = 7.3.6`\n- `communications_unified_inventory_management = 7.3.2`\n- `communications_unified_inventory_management = 7.3.4`\n- `communications_unified_inventory_management = 7.3.5`\n- `communications_unified_inventory_management = 7.4.0`\n- `communications_unified_inventory_management = 7.4.1`\n- `database = 12.1.0.2`\n- `database = 12.2.0.1`\n- `database = 18c`\n- `database = 19c`\n- `global_lifecycle_management_opatch < 12.2.0.1.22`\n- `goldengate < 19.1.0.0.0.210420`\n- `retail_assortment_planning = 15.0.3.0`\n- `retail_assortment_planning = 16.0.3.0`\n- `retail_integration_bus = 14.1`\n- `retail_integration_bus = 15.0`\n- `retail_integration_bus = 16.0`\n- `retail_predictive_application_server = 14.1.3.0`\n- `retail_predictive_application_server = 15.0`\n- `retail_predictive_application_server = 15.0.3.0`\n- `retail_predictive_application_server = 16.0.3.0`\n- `retail_service_backbone = 14.1`\n- `retail_service_backbone = 15.0`\n- `retail_service_backbone = 16.0`\n- `retail_store_inventory_management = 14.0.4`\n- `retail_store_inventory_management = 14.1.3`\n- `retail_store_inventory_management = 15.0.3`\n- `retail_store_inventory_management = 16.0.3`\n- `retail_xstore_point_of_service = 15.0.3`\n- `retail_xstore_point_of_service = 16.0.5`\n- `retail_xstore_point_of_service = 17.0.3`\n- `retail_xstore_point_of_service = 18.0.2`\n- `retail_xstore_point_of_service = 19.0.1`\n- `storagetek_acsls = 8.5.1`\n- `storagetek_tape_analytics_sw_tool = 2.3`\n- `weblogic_server = 10.3.6.0.0`\n- `weblogic_server = 12.1.3.0.0`\n- `weblogic_server = 12.2.1.3.0`\n- `weblogic_server = 12.2.1.4.0`\n- `weblogic_server = 14.1.1.0.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `bsafe_crypto-j 6.2.5`\n- `global_lifecycle_management_opatch 12.2.0.1.22`\n- `goldengate 19.1.0.0.0.210420`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":35.8,"likelihood":0.8,"exploitation":0,"ransomware":0},"changes":[]}