CVE-2019-3739: Dell Bsafe Cert-J

Medium severity, CVSS 6.5. EPSS: 2.5% chance of exploitation in the next 30 days.

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.

Affected products

• Dell Bsafe Cert-J: up to and including 6.2.4
• Dell Bsafe Crypto-J: before 6.2.5 (fixed in 6.2.5)
• Dell Bsafe SSL-J: up to and including 6.2.4.1
• Oracle Application Performance Management: version 13.3.0.0 only; version 13.4.0.0 only
• Oracle Communications Network Integrity: version 7.3.2 only; version 7.3.5 only; version 7.3.6 only
• Oracle Database: version 12.1.0.2 only; version 12.2.0.1 only; version 18c only; version 19c only
• Oracle Goldengate: before 19.1.0.0.0.210420 (fixed in 19.1.0.0.0.210420)
• Oracle Retail Assortment Planning: version 15.0.3.0 only; version 16.0.3.0 only
• Oracle Retail Integration Bus: version 14.1 only; version 15.0 only; version 16.0 only
• Oracle Retail Predictive Application Server: version 14.1.3.0 only; version 15.0.3.0 only; version 16.0.3.0 only
• Oracle Retail Service Backbone: version 14.1 only; version 15.0 only; version 16.0 only
• Oracle Retail Store Inventory Management: version 14.0.4 only; version 14.1.3 only; version 15.0.3 only; version 16.0.3 only
• Oracle Retail Xstore Point Of Service: version 15.0.3 only; version 16.0.5 only; version 17.0.3 only; version 18.0.2 only; version 19.0.1 only
• Oracle Storagetek Acsls: version 8.5.1 only
• Oracle Storagetek Tape Analytics Sw Tool: version 2.3 only
• Oracle WebLogic Server: version 10.3.6.0.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only; version 14.1.1.0.0 only

Published 2019-09-18. Last modified 2026-10-08.