CVE-2020-26939

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203

Affected software

No affected versions have been published.

Timeline

Published: Nov 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-26943.1Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are CVE-2020-269415.5A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of an CVE-2020-269429.1An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a CVE-2020-269439.9An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horiz CVE-2020-269449.8An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the CVE-2020-269458.1MyBatis before 3.5.6 mishandles deserialization of object streams.CVE-2020-269477.8monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which a CVE-2020-269489.8Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.CVE-2020-26955.3Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Approval Framework). Suppo CVE-2020-269508.8In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condi CVE-2020-269516.1A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker alre CVE-2020-269528.8Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash wh