CVE-2024-30171

mediumpriority · track · 0EPSS 0.009 · 59 %ileDEEUFRNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.90% (59th) EPSS

CVSS 5.9 · medium

Is it mine?

197 products

Check your exposure

Who says so?

9 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-22

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSIDIS Primesiemens_psirt
Update to V4.0.800 or later version
FixedSIDIS Primecisa_csaf_ot
Update to V4.0.800 or later version

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.4–7.5

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · CISA US

v3.15.9mediumAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 2.2 · impact 3.6

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · Siemens ProductCERT DE

v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-203USCWE-203USCWE-203USCWE-203USCWE-203USCWE-208US

affected products (197)

Products and version ranges known to be affected.

Atlassian Bitbucketall versionscert_bundDEcpe:/a:atlassian:bitbucket:-
Atlassian Bitbucket <8.19.16all versionscert_bundDE
Atlassian Bitbucket <8.9.26all versionscert_bundDE
Atlassian Bitbucket <9.4.4all versionscert_bundDE
Atlassian Bitbucket <9.5.2all versionscert_bundDE
Atlassian Confluence <7.19.26all versionscert_bundDE
Atlassian Confluence <8.5.12all versionscert_bundDE
Atlassian Confluence <8.9.4all versionscert_bundDE
Atlassian Confluence <9.0.1all versionscert_bundDE
Dell Secure Connect Gateway <5.34.00.16all versionscert_bundDE
Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
IBM DB2all versionscert_bundDEcpe:/a:ibm:db2:-
IBM License Metric Tool 9.2all versionscert_bundDEcpe:/a:ibm:license_metric_tool:9.2
IBM MQall versionscert_bundDEcpe:/a:ibm:mq:-
IBM QRadar SIEM <7.5.0 UP9all versionscert_bundDE
IBM SPSS Collaboration and Deployment Services 8.5all versionscert_bundDEcpe:/a:ibm:spss:collaboration_and_deployment_services_8.5
IBM Security Guardiumall versionscert_bundDEcpe:/a:ibm:security_guardium:-
IBM Storage Scale 5.1.0.0-5.1.9.4all versionscert_bundDEcpe:/a:ibm:spectrum_scale:5.1.0.0_-_5.1.9.4
IBM Storage Scale <5.1.9.5all versionscert_bundDE
IBM Storage Scale <5.2.1.0all versionscert_bundDE

showing 20 of 197

advisories (9)

Vendor and ecosystem advisories describing this.

NCSC-2025-0027Kwetsbaarheden verholpen in Oracle Fusion MiddlewareNL2025-01-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in zijn producten, waaronder Oracle Fusion Middleware, Oracle WebLogic Server, en Oracle HTTP Server.
NCSC-2026-0079Kwetsbaarheden verholpen in Siemens productenNL2026-03-10csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Heliox, Ruggedcom, SICAM, SIDIS en SIMATIC.
SSA-485750SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.8002026-03-10csaf · siemens_psirtDE
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
WID-SEC-W-2024-1031Bouncy Castle: Mehrere SchwachstellenDeutsch2024-05-05csaf · cert_bundDE
Ein anonymer Angreifer kann mehrere Schwachstellen in Bouncy Castle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen DNS-Poisoning-Angriff durchzuführen.
WID-SEC-W-2024-1912SOS GmbH JobScheduler: Mehrere SchwachstellenDeutsch2024-08-22csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SOS GmbH JobScheduler ausnutzen, um Daten zu verändern, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu erzeugen.
GHSA-v435-xc8x-wvr9Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")2024-05-14ghsa · osvUS
An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.
ICSA-26-071-03Siemens SIDIS Prime2026-03-10icsa · cisa_csaf_otUS
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR
CGA-5mrq-75x2-g8hj2024-06-06vendor · osvUS

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl siemens_psirt cisa_csaf_ot certfr NVD CVE.org MITRE

published 2024-05-14modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan