--- id: CVE-2019-3740 title: >- RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation summary: >- RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to rec… severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N' cwe: - CWE-310 - CWE-203 vendor: dell product: bsafe_cert-j affected: - bsafe_cert-j <= 6.2.4 - bsafe_crypto-j < 6.2.5 - bsafe_ssl-j <= 6.2.4.1 - application_performance_management = 13.3.0.0 - application_performance_management = 13.4.0.0 - communications_network_integrity = 7.3.2 - communications_network_integrity = 7.3.5 - communications_network_integrity = 7.3.6 - communications_unified_inventory_management = 7.3.2 - communications_unified_inventory_management = 7.3.4 - communications_unified_inventory_management = 7.3.5 - communications_unified_inventory_management = 7.4.0 - communications_unified_inventory_management = 7.4.1 - database = 12.1.0.2 - database = 12.2.0.1 - database = 18c - database = 19c - global_lifecycle_management_opatch < 12.2.0.1.22 - goldengate < 19.1.0.0.0.210420 - retail_assortment_planning = 15.0.3.0 - retail_assortment_planning = 16.0.3.0 - retail_integration_bus = 14.1 - retail_integration_bus = 15.0 - retail_integration_bus = 16.0 - retail_predictive_application_server = 14.1.3.0 - retail_predictive_application_server = 15.0 - retail_predictive_application_server = 15.0.3.0 - retail_predictive_application_server = 16.0.3.0 - retail_service_backbone = 14.1 - retail_service_backbone = 15.0 - retail_service_backbone = 16.0 - retail_store_inventory_management = 14.0.4 - retail_store_inventory_management = 14.1.3 - retail_store_inventory_management = 15.0.3 - retail_store_inventory_management = 16.0.3 - retail_xstore_point_of_service = 15.0.3 - retail_xstore_point_of_service = 16.0.5 - retail_xstore_point_of_service = 17.0.3 - retail_xstore_point_of_service = 18.0.2 - retail_xstore_point_of_service = 19.0.1 - storagetek_acsls = 8.5.1 - storagetek_tape_analytics_sw_tool = 2.3 - weblogic_server = 10.3.6.0.0 - weblogic_server = 12.1.3.0.0 - weblogic_server = 12.2.1.3.0 - weblogic_server = 12.2.1.4.0 - weblogic_server = 14.1.1.0.0 patched: - bsafe_crypto-j 6.2.5 - global_lifecycle_management_opatch 12.2.0.1.22 - goldengate 19.1.0.0.0.210420 published: '2019-09-18' updated: '2026-10-08' sourceUpdated: '2026-10-08T22:16:54.987' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-3740' references: - url: >- https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE®%3B-Crypto-J-Multiple-Security-Vulnerabilities label: security_alert@emc.com - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: security_alert@emc.com - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: security_alert@emc.com - url: >- https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE®%3B-Crypto-J-Multiple-Security-Vulnerabilities label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.03753 epssPercentile: 0.89594 ingestedAt: '2026-10-08T23:16:47.299Z' --- ## Overview RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys. ## Affected - `bsafe_cert-j <= 6.2.4` - `bsafe_crypto-j < 6.2.5` - `bsafe_ssl-j <= 6.2.4.1` - `application_performance_management = 13.3.0.0` - `application_performance_management = 13.4.0.0` - `communications_network_integrity = 7.3.2` - `communications_network_integrity = 7.3.5` - `communications_network_integrity = 7.3.6` - `communications_unified_inventory_management = 7.3.2` - `communications_unified_inventory_management = 7.3.4` - `communications_unified_inventory_management = 7.3.5` - `communications_unified_inventory_management = 7.4.0` - `communications_unified_inventory_management = 7.4.1` - `database = 12.1.0.2` - `database = 12.2.0.1` - `database = 18c` - `database = 19c` - `global_lifecycle_management_opatch < 12.2.0.1.22` - `goldengate < 19.1.0.0.0.210420` - `retail_assortment_planning = 15.0.3.0` - `retail_assortment_planning = 16.0.3.0` - `retail_integration_bus = 14.1` - `retail_integration_bus = 15.0` - `retail_integration_bus = 16.0` - `retail_predictive_application_server = 14.1.3.0` - `retail_predictive_application_server = 15.0` - `retail_predictive_application_server = 15.0.3.0` - `retail_predictive_application_server = 16.0.3.0` - `retail_service_backbone = 14.1` - `retail_service_backbone = 15.0` - `retail_service_backbone = 16.0` - `retail_store_inventory_management = 14.0.4` - `retail_store_inventory_management = 14.1.3` - `retail_store_inventory_management = 15.0.3` - `retail_store_inventory_management = 16.0.3` - `retail_xstore_point_of_service = 15.0.3` - `retail_xstore_point_of_service = 16.0.5` - `retail_xstore_point_of_service = 17.0.3` - `retail_xstore_point_of_service = 18.0.2` - `retail_xstore_point_of_service = 19.0.1` - `storagetek_acsls = 8.5.1` - `storagetek_tape_analytics_sw_tool = 2.3` - `weblogic_server = 10.3.6.0.0` - `weblogic_server = 12.1.3.0.0` - `weblogic_server = 12.2.1.3.0` - `weblogic_server = 12.2.1.4.0` - `weblogic_server = 14.1.1.0.0` ## Remediation Upgrade past the affected range: - `bsafe_crypto-j 6.2.5` - `global_lifecycle_management_opatch 12.2.0.1.22` - `goldengate 19.1.0.0.0.210420`