PT-2018-4640 · Bouncy Castle+3 · Bouncy Castle Jce Provider+3

Publicado 2018-06-04 · Atualizado 2024-06-15 · CVE-2016-1000346

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions prior to 1.56

Description The issue arises from insufficient validation of the other party's Diffie-Hellman public key, potentially allowing invalid keys to reveal details about the other party's private key when static Diffie-Hellman is used.

Recommendations For Bouncy Castle JCE Provider versions prior to 1.56, update to version 1.56 or later, where key parameters are checked during agreement calculation to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-320

Identificadores relacionados

CVE-2016-1000346

DLA-1418-1

GHSA-FJQM-246C-MWQG

MGASA-2018-0376

OPENSUSE-SU-2018_1689-1

OPENSUSE-SU-2024:10661-1

RHSA-2018:2927

USN-3727-1

Produtos afetados

Bouncy Castle Jce Provider

Jira

Suse

Ubuntu

Referências · 51

• https://github.com/bcgit/bc-java · Nota
• https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937 · Correção
• https://ubuntu.com/security/notices/USN-3727-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-1000346 · Nota
• https://access.redhat.com/errata/RHSA-2018:2669 · Aviso do Fabricante
• https://usn.ubuntu.com/3727-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-1000342 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-1000341 · Nota
• https://debian.org/security/2018/dsa-4233 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1000613 · Nota
• https://osv.dev/vulnerability/DLA-1418-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1000180 · Nota
• https://oracle.com/security-alerts/cpuoct2020.html · Nota
• https://suse.com/security/cve/CVE-2016-1000342 · Nota
• https://osv.dev/vulnerability/GHSA-fjqm-246c-mwqg · Aviso do Fabricante