CVE-2019-3738
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of...
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
- Record
CVE-2019-3738- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-325
- Updated
- 2026-11-02
EUVDEUVD-2019-13373
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
- Record
EUVD-2019-13373- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vq8w-mhc4-p67j
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of...
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
- Record
GHSA-vq8w-mhc4-p67j- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-325, CWE-347
- Updated
- 2026-11-02
NVD
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
- Record
CVE-2019-3738- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-325, CWE-347
- Updated
- 2026-11-02
Affected products
- dell bsafe crypto-j
- dell rsa bsafe crypto-j
- dell bsafe cert-j
- dell bsafe ssl-j
- mcafee threat intelligence exchange server
- oracle application performance management
- oracle communications network integrity
- oracle communications unified inventory management
- oracle database
- oracle goldengate
- oracle retail assortment planning
- oracle retail integration bus
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-3738 is a medium vulnerability (CVSS 6.5) in Dell Bsafe Crypto-j, published September 18, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 77th percentile. No source names a fixed version.