Bouncy Castle JCE Provider up to 1.55 DHIES cryptographic issue

Summaryinfo

A vulnerability, which was classified as critical, was found in Bouncy Castle JCE Provider up to 1.55. Affected by this issue is some unknown functionality of the component DHIES. Executing a manipulation can lead to cryptographic issue. The identification of this vulnerability is CVE-2016-1000344. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Bouncy Castle JCE Provider up to 1.55. It has been declared as critical. This vulnerability affects some unknown functionality of the component DHIES. The manipulation with an unknown input leads to a cryptographic issue vulnerability. The CWE definition for the vulnerability is CWE-310. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

The bug was discovered 07/07/2018. The weakness was shared 06/04/2018 (GitHub Repository). The advisory is available at github.com. This vulnerability was named CVE-2016-1000344 since 06/04/2018. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 110530 (openSUSE Security Update : bouncycastle (openSUSE-2018-628)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 171315 (OpenSUSE Security Update for bouncycastle (openSUSE-SU-2018:1689-1)).

Upgrading eliminates this vulnerability. A possible mitigation has been published 2 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Tenable (110530) and EUVD (EUVD-2018-0476). The entries VDB-118820, VDB-118821, VDB-118822 and VDB-118823 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Bouncy Castle

Name

• JCE Provider

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47
• 1.48
• 1.49
• 1.50
• 1.51
• 1.52
• 1.53
• 1.54
• 1.55

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion