Security update for bouncycastle SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2163-1 Final 1 1 2021-06-25T16:03:55Z current 2021-06-25T16:03:55Z 2021-06-25T16:03:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for bouncycastle This update for bouncycastle fixes the following issues: - CVE-2020-15522: Fixed a timing issue within the EC math library (bsc#1186328). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-2163,SUSE-SLE-Module-Development-Tools-15-SP2-2021-2163,SUSE-SLE-Module-Development-Tools-15-SP3-2021-2163 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212163-1/ Link for SUSE-SU-2021:2163-1 https://lists.suse.com/pipermail/sle-security-updates/2021-June/009091.html E-Mail link for SUSE-SU-2021:2163-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1186328 SUSE Bug 1186328 https://www.suse.com/security/cve/CVE-2020-15522/ SUSE CVE CVE-2020-15522 page SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 bouncycastle-1.64-3.3.1 bouncycastle-javadoc-1.64-3.3.1 bouncycastle-mail-1.64-3.3.1 bouncycastle-pg-1.64-3.3.1 bouncycastle-pkix-1.64-3.3.1 bouncycastle-tls-1.64-3.3.1 bouncycastle-1.64-3.3.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 bouncycastle-pg-1.64-3.3.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 bouncycastle-1.64-3.3.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 bouncycastle-pg-1.64-3.3.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures. CVE-2020-15522 SUSE Linux Enterprise Module for Development Tools 15 SP2:bouncycastle-1.64-3.3.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:bouncycastle-pg-1.64-3.3.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:bouncycastle-1.64-3.3.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:bouncycastle-pg-1.64-3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212163-1/ https://www.suse.com/security/cve/CVE-2020-15522.html CVE-2020-15522 https://bugzilla.suse.com/1186328 SUSE Bug 1186328