CVE 2020 26939

Issue affecting: BC-FJA 1.0.0, BC-FJA 1.0.1, BC 1.54 or earlier.

Fixed versions: BC-FJA 1.0.1.2, BC-FJA 1.0.2 and later, BC 1.55 or later

Sending an invalid cipher text which decrypted to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.

See commit https://github.com/bcgit/bc-java/commit/930f8b274c4f1f3a46e68b5441f1e7fadb57e8c1 for the changes.