CVE-2018-11070: RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Tim...

Security readout for executives and security teams

This vulnerability affects older RSA BSAFE Crypto-J and SSL-J cryptographic libraries. A remote attacker could potentially use subtle timing differences in RSA PKCS #1 unpadding to recover an RSA key. The attack is complex, but the business impact can be serious where affected libraries protect sensitive communications. Exposure is most likely in legacy applications, middleware, or products embedding RSA BSAFE Crypto-J or SSL-J before version 6.2.4. Internet-facing TLS or RSA-processing services deserve priority review, but the supplied sources do not identify specific downstream bundled products. Treat this as a targeted legacy cryptography risk, not an emergency mass-exploitation event. Prioritize inventory and upgrades for externally reachable systems because key recovery would create serious confidentiality consequences if exploitation were practical in your environment. Mitigation focus: Inventory systems using RSA BSAFE Crypto-J or SSL-J.; Upgrade affected libraries to version 6.2.4 or later where supported.; Check Dell EMC or vendor guidance for product-specific remediation..

Prepared

May 25, 2026, 05:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.