CVEvulnerability
CVE-2016-1000338
7.5 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2018-06-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-347
Description
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Affected configurations
• bouncycastle legion-of-the-bouncy-castle-java-crytography-api (>= 1.38 < 1.56)
• redhat satellite 6.4
• redhat satellite capsule 6.4
• canonical ubuntu linux 14.04
• netapp 7-mode transition tool
Related
Weakness · CWE (1)
- CWE-347 Improper Verification of Cryptographic Signature weakness
References
- https://access.redhat.com/errata/RHSA-2018:2669 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2927 Third Party Advisory
- https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0 Patch, Third Party Advisory
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231006-0011/ Third Party Advisory
- https://usn.ubuntu.com/3727-1/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2669 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2927 Third Party Advisory
- https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0 Patch, Third Party Advisory
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231006-0011/ Third Party Advisory
- https://usn.ubuntu.com/3727-1/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory