漏洞标题
N/A
漏洞描述信息
在 Bouncy Castle JCE Provider 版本1.55 及更早之前，用于 AES 的主要引擎类是 AESFastEngine。由于算法中使用了高度表驱动的方法，我们发现如果可以监测 CPU 中的数据通道，那么 lookup 表的访问足以泄露用于使用的 AES 密钥的信息。在 AESEngine 中也存在泄漏，尽管程度较轻。 AESEngine 已经进行了修改，以消除任何泄漏的迹象(在 Intel X86-64 上进行测试)。因此，除非其他情况下认为有必要，否则只建议使用 AESFastEngine。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Bouncy Castle JCE Provider AESFastEngine和AESEngine 加密问题漏洞
漏洞描述信息
Bouncy Castle JCE Provider是一款基于Java的加密包。AESFastEngine和AESEngine都是其中的加密引擎。 Bouncy Castle JCE Provider 1.55及之前版本中的AESFastEngine和AESEngine存在安全漏洞。攻击者可利用该漏洞泄露有关AES密钥的信息。
CVSS信息
N/A
漏洞类别
加密问题