GitHub Advisoryadvisory · Maven

GHSA-qcj7-g2j5-g7r3 In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification

HIGH Published 2018-10-17 Modified 2025-09-02 Official page ↗
Aliases
CVE-2016-1000342
Ecosystem
Maven
Packages
org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15, org.bouncycastle:bcprov-jdk15on
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-347
Reviewed
2020-06-16

Affected packages

• Maven org.bouncycastle:bcprov-jdk14: < 1.56 → fixed in 1.56 • Maven org.bouncycastle:bcprov-jdk15: < 1.56 → fixed in 1.56 • Maven org.bouncycastle:bcprov-jdk15on: < 1.56 → fixed in 1.56

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Related

Alias · CVE (1)

  • CVE-2016-1000342 In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References