Security readout for executives and security teams
Plain-English summary
RSA BSAFE Crypto-J before 6.2.5 can mishandle a required cryptographic step. In affected software, a remote attacker could potentially influence a key exchange so both parties compute a predictable shared key, putting confidential data at risk.
Executive priority
Treat as a moderate-priority confidentiality risk, especially where legacy Java applications or third-party enterprise products rely on RSA BSAFE Crypto-J. Prioritize inventory first, then patch affected cryptographic dependencies or vendor products.
Technical view
CVE-2019-3738 is a CWE-325 issue in Dell RSA BSAFE Crypto-J before 6.2.5. The CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, reflecting remote reachability, required user interaction, and high confidentiality impact.
Likely exposure
Exposure is most likely in applications or vendor products that embed RSA BSAFE Crypto-J versions prior to 6.2.5. The source bundle lists Dell RSA BSAFE Crypto-J and references Oracle and McAfee advisories, indicating possible downstream dependency impact.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. The described risk is cryptographic: a malicious remote attacker could potentially coerce two parties into deriving the same predictable shared key. User interaction is required in the CVSS vector.
Researcher notes
Evidence is limited to public CVE metadata and referenced vendor advisories. The weakness is missing required cryptographic processing, not an availability or integrity issue per CVSS. Avoid assuming exploit availability, affected downstream products, or compensating controls beyond vendor guidance.
Mitigation direction
- Inventory applications and vendor products that include RSA BSAFE Crypto-J.
- Upgrade RSA BSAFE Crypto-J to 6.2.5 or later where applicable.
- Review Dell RSA BSAFE advisory DSA-2019-094 for vendor-specific guidance.
- Apply relevant Oracle or McAfee product updates if those products are in scope.
- If no direct patch is available, request vendor guidance for the embedded component.
Validation and detection
- Check SBOMs, dependency records, and runtime packaging for RSA BSAFE Crypto-J.
- Confirm deployed Crypto-J versions are 6.2.5 or later.
- Map Oracle and McAfee advisories to owned products and versions.
- Verify remediation through vendor release notes or product inventory evidence.
- Document any systems still relying on unsupported or unpatched embedded copies.
Public sources used
- CVE Program
- CVE List V5
- Dell DSA-2019-094 RSA BSAFE Crypto-J Multiple Security Vulnerabilities
- Oracle Critical Patch Update July 2020
- Oracle Critical Patch Update October 2020
- McAfee Security Bulletin SB10318
- Oracle Critical Patch Update April 2021
- Oracle Critical Patch Update July 2021
- Oracle Critical Patch Update October 2021
- Oracle Critical Patch Update April 2022
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-325: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-3738 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
6.5MediumVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpujul2020.htmlCVE reference · x_refsource_MISC
- https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE®%3B-Crypto-J-Multiple-Security-VulnerabilitiesCVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuoct2020.htmlCVE reference · x_refsource_MISC
- https://kc.mcafee.com/corporate/index?page=content&id=SB10318CVE reference · x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuApr2021.htmlCVE reference · x_refsource_MISC
- https://www.oracle.com//security-alerts/cpujul2021.htmlCVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuoct2021.htmlCVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Cryptographic Step
Missing Cryptographic Step represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.