CVE-2020-15522: Timing based private key exposure in Bouncy Castle
5.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.62412%
CWE
Published
8/13/2021
Updated
5/30/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.bouncycastle:bc-fips | maven | <= 1.0.2 | 1.0.2.1 |
| org.bouncycastle:bcprov-ext-jdk15on | maven | < 1.66 | 1.66 |
| org.bouncycastle:bcprov-ext-jdk16 | maven | < 1.66 | 1.66 |
| org.bouncycastle:bcprov-jdk14 | maven | < 1.66 | 1.66 |
| org.bouncycastle:bcprov-jdk15 | maven | < 1.66 | 1.66 |
| org.bouncycastle:bcprov-jdk15on | maven | < 1.66 | 1.66 |
| org.bouncycastle:bcprov-jdk15to18 | maven | < 1.66 | 1.66 |
| org.bouncycastle:bcprov-jdk16 | maven | < 1.66 | 1.66 |
| BouncyCastle | nuget | < 1.8.7 | 1.8.7 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from non-constant-time implementation of EC scalar multiplication in deterministic ECDSA. The Bouncy Castle wiki explicitly references ECPoint.implShamirsTrickWNaf as the location where blinding was added to mitigate timing attacks. This method is critical for signature generation and would appear in profiler traces during cryptographic operations. The lack of blinding in vulnerable versions made execution time dependent on private key bits, enabling side-channel analysis.