GitHub Advisoryadvisory · Maven

GHSA-fjqm-246c-mwqg In Bouncy Castle JCE Provider the other party DH public key is not fully validated

LOW Published 2018-10-17 Modified 2025-09-12 Official page ↗
Aliases
CVE-2016-1000346
Ecosystem
Maven
Packages
org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15, org.bouncycastle:bcprov-jdk15on
Severity
Low
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Reviewed
2020-06-16

Affected packages

• Maven org.bouncycastle:bcprov-jdk14: < 1.56 → fixed in 1.56 • Maven org.bouncycastle:bcprov-jdk15: < 1.56 → fixed in 1.56 • Maven org.bouncycastle:bcprov-jdk15on: < 1.56 → fixed in 1.56

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

Related

Alias · CVE (1)

  • CVE-2016-1000346 In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. vulnerability

References