CVE-2017-13098

High · 7.5

CVSS

7.5

EPSS

24.3%

Published

Dec 13, 2017

CISA due date

—

The record

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."

Affected packages

Ecosystem	Package	Fixed
Maven	org.bouncycastle:bcprov-jdk15on	1.0.3
Debian:11	bouncycastle	1.58-1
Debian:12	bouncycastle	1.58-1
Debian:13	bouncycastle	1.58-1
Debian:9	bouncycastle	1.56-1+deb9u1
Mageia:6	bouncycastle	1.60-1.mga6
Ubuntu:18.04:LTS	bouncycastle	1.59-1
openSUSE:Leap 15.1	bouncycastle	1.60-lp151.3.3.1
openSUSE:Tumbleweed	bouncycastle	1.68-3.2

Related vulnerabilities

CVE-2024-30172 An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. Also affects org.bouncycastle:bcprov-jdk15on
CVE-2024-30171 An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Also affects org.bouncycastle:bcprov-jdk15on
CVE-2024-29857 An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java)… Also affects org.bouncycastle:bcprov-jdk15on
CVE-2023-33201 Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. Also affects org.bouncycastle:bcprov-jdk15on
CVE-2025-8916 Allocation of Resources Without Limits or Throttling vulnerability in Legion of the… Also affects bouncycastle
CVE-2025-8885 Allocation of Resources Without Limits or Throttling vulnerability in Legion of the… Also affects bouncycastle
CVE-2024-34447 An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java… Also affects bouncycastle
CVE-2015-6644 Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers… Also affects bouncycastle