CVE-2019-3740: bsafe cert-j through 6.2.4 (inclusive); +18 more affected products

Affected technology

bsafe cert-j · through 6.2.4 (inclusive)
dell

bsafe crypto-j · before 6.2.5 (exclusive)
dell

bsafe ssl-j · through 6.2.4.1 (inclusive)
dell

application performance management · 13.3.0.0
oracle

application performance management · 13.4.0.0
oracle

communications network integrity · 7.3.2
oracle

communications network integrity · 7.3.5
oracle

communications network integrity · 7.3.6
oracle

communications unified inventory management · 7.3.2
oracle

communications unified inventory management · 7.3.4
oracle

communications unified inventory management · 7.3.5
oracle

communications unified inventory management · 7.4.0
oracle

communications unified inventory management · 7.4.1
oracle

database · 12.1.0.2
oracle

database · 12.2.0.1
oracle

database · 18c
oracle

database · 19c
oracle

global lifecycle management opatch · before 12.2.0.1.22 (exclusive)
oracle

goldengate · before 19.1.0.0.0.210420 (exclusive)
oracle

retail assortment planning · 15.0.3.0
oracle

retail assortment planning · 16.0.3.0
oracle

retail integration bus · 14.1
oracle

retail integration bus · 15.0
oracle

retail integration bus · 16.0
oracle

retail predictive application server · 14.1.3.0
oracle

retail predictive application server · 15.0
oracle

retail predictive application server · 15.0.3.0
oracle

retail predictive application server · 16.0.3.0
oracle

retail service backbone · 14.1
oracle

retail service backbone · 15.0
oracle

retail service backbone · 16.0
oracle

retail store inventory management · 14.0.4
oracle

retail store inventory management · 14.1.3
oracle

retail store inventory management · 15.0.3
oracle

retail store inventory management · 16.0.3
oracle

retail xstore point of service · 15.0.3
oracle

retail xstore point of service · 16.0.5
oracle

retail xstore point of service · 17.0.3
oracle

retail xstore point of service · 18.0.2
oracle

retail xstore point of service · 19.0.1
oracle

storagetek acsls · 8.5.1
oracle

storagetek tape analytics sw tool · 2.3
oracle

weblogic server · 10.3.6.0.0
oracle

weblogic server · 12.1.3.0.0
oracle

weblogic server · 12.2.1.3.0
oracle

weblogic server · 12.2.1.4.0
oracle

weblogic server · 14.1.1.0.0
oracle

RSA BSAFE Crypto-J · prior to 6.2.5
Dell

Description’s affected range: versions prior to 6.2.5

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys. NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as high; integrity and availability impact as none.