CVE-2018-11069: RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption...

Security readout for executives and security teams

RSA BSAFE SSL-J before 6.2.4 has a timing-channel weakness in RSA decryption. In the right conditions, a remote attacker could use timing differences to recover an RSA key. This is serious for confidentiality, but the public scoring indicates high attack complexity. Exposure is most likely in applications or products embedding RSA BSAFE SSL-J before 6.2.4. The provided sources do not identify specific downstream appliances, services, or deployment patterns, so inventory confirmation is required. Treat as a targeted confidentiality risk, not an internet-wide emergency based on current evidence. Prioritize inventory and vendor confirmation for systems protecting sensitive data or exposed to untrusted networks. Mitigation focus: Inventory systems and software that embed RSA BSAFE SSL-J.; Upgrade RSA BSAFE SSL-J to 6.2.4 or later where vendor guidance confirms applicability.; Check Dell EMC or product-vendor advisories for downstream fixed versions..

Prepared

May 25, 2026, 05:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.