CVE-2019-3738: Dell Bsafe Cert-J

Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days.

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.

Affected products

• Dell Bsafe Cert-J: up to and including 6.2.4
• Dell Bsafe Crypto-J: before 6.2.5 (fixed in 6.2.5)
• Dell Bsafe SSL-J: up to and including 6.2.4.1
• McAfee Threat Intelligence Exchange Server: from 2.0.0, up to and including 2.3.1; version 3.0.0 only
• Oracle Application Performance Management: version 13.3.0.0 only; version 13.4.0.0 only
• Oracle Communications Network Integrity: version 7.3.2 only; version 7.3.5 only; version 7.3.6 only
• Oracle Communications Unified Inventory Management: version 7.3.2 only; version 7.3.4 only; version 7.3.5 only; version 7.4.0 only; version 7.4.1 only
• Oracle Database: version 12.1.0.2 only; version 12.2.0.1 only; version 18c only; version 19c only
• Oracle Goldengate: before 19.1.0.0.0.210420 (fixed in 19.1.0.0.0.210420); version 19.1.0.0.0.210420 only
• Oracle Retail Assortment Planning: version 15.0.3.0 only; version 16.0.3.0 only
• Oracle Retail Integration Bus: version 14.1 only; version 15.0 only; version 16.0 only
• Oracle Retail Predictive Application Server: version 14.1.3.0 only; version 15.0.3.0 only; version 16.0.3.0 only
• Oracle Retail Service Backbone: version 14.1 only; version 15.0 only; version 16.0 only
• Oracle Retail Store Inventory Management: version 14.0.4 only; version 14.1.3 only; version 15.0.3 only; version 16.0.3 only
• Oracle Retail Xstore Point Of Service: version 15.0.3 only; version 16.0.5 only; version 17.0.3 only; version 18.0.2 only; version 19.0.1 only
• Oracle Storagetek Tape Analytics Sw Tool: version 2.3 only

Published 2019-09-18. Last modified 2026-06-17.