{"action":"Upgrade org.bouncycastle:bctls-jdk18on to 1.78 or later.","affected":[{"fixed":"1.78","introduced":"0"}],"component":"org.bouncycastle:bctls-jdk18on","cve_ids":["CVE-2024-30171"],"ecosystem":"Maven","epss":0.00901,"exploited":false,"fixed_versions":["1.78"],"ghsa_id":"GHSA-v435-xc8x-wvr9","id":"tcs_01M5N91091JQPRHA88K8QMMY2Z","modified_at":"2026-09-10T03:50:14.807195189Z","published_at":"2024-05-14T15:32:54Z","references":["https://osv.dev/vulnerability/GHSA-v435-xc8x-wvr9","https://nvd.nist.gov/vuln/detail/CVE-2024-30171","https://github.com/bcgit/bc-csharp/commit/c984b8bfd8544dfc55dba91a02cbbbb9c580c217","https://github.com/bcgit/bc-java/commit/d7d5e735abd64bf0f413f54fd9e495fc02400fb0","https://github.com/bcgit/bc-java/commit/e0569dcb1dea9d421d84fc4c5c5688fe101afa2d","https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030171","https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030171","https://security.netapp.com/advisory/ntap-20240614-0008","https://www.bouncycastle.org/latest_releases.html"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-v435-xc8x-wvr9#Maven/org.bouncycastle:bctls-jdk18on","url":"https://osv.dev/vulnerability/GHSA-v435-xc8x-wvr9"}],"summary":"Bouncy Castle affected by timing side-channel for RSA key exchange (\"The Marvin Attack\")"}