RSA BSAFE Micro Edition Suite versions prior to 4.4 (in 4.0.x, 4.1.x, 4.2.x and 4.3.x) are vulnerable to a Heap-based Buffer Overflow vulnerability when parsing ECDSA signature. A malicious user with

Successful exploitation of CVE-2019-3729 requires an attacker with adjacent network access to the affected system. While the vulnerability is classified as LOW severity, the impact can be significant. An attacker could trigger the buffer overflow by sending a specially crafted ECDSA signature, leading to a crash of the BSAFE MES library. This crash can disrupt services relying on the library, potentially causing downtime and impacting critical operations. The vulnerability does not appear to provide a direct path to remote code execution (RCE), but a denial of service can be a disruptive attack vector in itself.

1. आरक्षित2019-01-03
2. प्रकाशित2019-09-30
3. संशोधित2024-09-16
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2019-3729 is to upgrade to RSA BSAFE MES version 4.4 or later. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider implementing network segmentation to restrict access to the affected system from untrusted networks. While a direct workaround to prevent the overflow isn't readily available, carefully validating ECDSA signatures received from external sources can reduce the attack surface. After upgrading, confirm the fix by attempting to parse a known malicious ECDSA signature – the library should not crash.