GitHub Advisoryadvisory · Maven
GHSA-9gp4-qrff-c648 Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
MEDIUM
Official page ↗
- Aliases
- CVE-2016-1000345
- Ecosystem
- Maven
- Packages
- org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15, org.bouncycastle:bcprov-jdk15on
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Reviewed
- 2020-06-16
Affected packages
• Maven org.bouncycastle:bcprov-jdk14: < 1.56 → fixed in 1.56
• Maven org.bouncycastle:bcprov-jdk15: < 1.56 → fixed in 1.56
• Maven org.bouncycastle:bcprov-jdk15on: < 1.56 → fixed in 1.56
Description
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
Related
Alias · CVE (1)
- CVE-2016-1000345 In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000345 advisory
- https://github.com/bcgit/bc-java/commit/21dcb3d9744c83dcf2ff8fcee06dbca7bfa4ef35#diff-4439ce586bf9a13bfec05c0d113b8098 web
- https://access.redhat.com/errata/RHSA-2018:2669 web
- https://access.redhat.com/errata/RHSA-2018:2927 web
- https://github.com/advisories/GHSA-9gp4-qrff-c648 advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html web
- https://security.netapp.com/advisory/ntap-20181127-0004 web
- https://usn.ubuntu.com/3727-1 web
- https://www.oracle.com/security-alerts/cpuoct2020.html web