PT-2018-4635 · Bouncy Castle+3 · Bouncy Castle Jce Provider+3

CVE-2016-1000341

·

Publicado

2018-06-04

·

Atualizado

2025-05-12

CVSS v3.1

5.9

Média

VetorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions 1.55 and earlier
Description The issue concerns a timing attack vulnerability in DSA signature generation. When timings can be closely observed for the generation of signatures, the lack of blinding may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
Recommendations For Bouncy Castle JCE Provider versions 1.55 and earlier, consider updating to a version that includes blinding in DSA signature generation to prevent timing attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-361

Identificadores relacionados

CVE-2016-1000341
DLA-1418-1
GHSA-R9CH-M4FH-FC7Q
MGASA-2018-0376
OPENSUSE-SU-2018_1689-1
OPENSUSE-SU-2024:10661-1
RHSA-2018:2927
USN-3727-1

Produtos afetados

Bouncy Castle Jce Provider
Jira
Suse
Ubuntu