CVE-2017-13098: Observable Discrepancy
(updated )
BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as “ROBOT.”
References
- lists.opensuse.org/opensuse-security-announce/2020-05/msg00011.html
- www.kb.cert.org/vuls/id/144389
- github.com/advisories/GHSA-wrwf-pmmj-w989
- github.com/bcgit/bc-java/commit/a00b684465b38d722ca9a3543b8af8568e6bad5c
- nvd.nist.gov/vuln/detail/CVE-2017-13098
- robotattack.org/
- security.netapp.com/advisory/ntap-20171222-0001/
- www.debian.org/security/2017/dsa-4072
- www.oracle.com/security-alerts/cpuoct2020.html
Code Behaviors & Features
Detect and mitigate CVE-2017-13098 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →