NuGet/BouncyCastle.Cryptography CVE-2024-30171: medium 5.9, EPSS 0.90%

Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")

Action: Upgrade BouncyCastle.Cryptography to 2.3.1 or later.

Affected

Fixed versions

Sources

• osv: GHSA-v435-xc8x-wvr9#NuGet/BouncyCastle.Cryptography
• https://nvd.nist.gov/vuln/detail/CVE-2024-30171
• https://github.com/bcgit/bc-csharp/commit/c984b8bfd8544dfc55dba91a02cbbbb9c580c217
• https://github.com/bcgit/bc-java/commit/d7d5e735abd64bf0f413f54fd9e495fc02400fb0
• https://github.com/bcgit/bc-java/commit/e0569dcb1dea9d421d84fc4c5c5688fe101afa2d
• https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030171
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030171
• https://security.netapp.com/advisory/ntap-20240614-0008
• https://www.bouncycastle.org/latest_releases.html

CVE-2024-30171 · published 2024-05-14T15:32:54Z · modified 2026-09-10T03:50:14.807195189Z · JSON