CVEvulnerability
CVE-2016-1000346
3.7 LOW
Official page ↗
- Status
- Modified
- Published
- 2018-06-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 3.7 LOW — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-320
Description
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
Affected configurations
• bouncycastle bc-java (<= 1.55)
• debian debian linux 8.0
Related
Weakness · not in database (1)
References
- https://access.redhat.com/errata/RHSA-2018:2669 access.redhat.com
- https://access.redhat.com/errata/RHSA-2018:2927 access.redhat.com
- https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html Third Party Advisory
- https://security.netapp.com/advisory/ntap-20181127-0004/ security.netapp.com
- https://usn.ubuntu.com/3727-1/ usn.ubuntu.com
- https://www.oracle.com/security-alerts/cpuoct2020.html www.oracle.com
- https://access.redhat.com/errata/RHSA-2018:2669 access.redhat.com
- https://access.redhat.com/errata/RHSA-2018:2927 access.redhat.com
- https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html Third Party Advisory
- https://security.netapp.com/advisory/ntap-20181127-0004/ security.netapp.com
- https://usn.ubuntu.com/3727-1/ usn.ubuntu.com
- https://www.oracle.com/security-alerts/cpuoct2020.html www.oracle.com