PT-2018-4641 · Bouncy Castle+2 · Bouncy Castle Jce Provider+2

Publicado 2018-06-04 · Atualizado 2024-06-15 · CVE-2016-1000352

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions 1.55 and earlier

Description The issue concerns the use of ECB mode in the ECIES implementation, which is considered unsafe. Support for this mode has been removed due to its unsafe nature.

Recommendations For Bouncy Castle JCE Provider versions 1.55 and earlier, consider updating to a version where ECB mode support has been removed to mitigate the risk.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

CWE-310

Identificadores relacionados

CVE-2016-1000352

GHSA-W285-WF9Q-5W69

MGASA-2018-0376

OPENSUSE-SU-2018_1689-1

OPENSUSE-SU-2024:10661-1

RHSA-2018:2927

Produtos afetados

Bouncy Castle Jce Provider

Jira

Suse

Referências · 38

• https://github.com/bcgit/bc-java · Nota
• https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f · Correção
• https://suse.com/security/cve/CVE-2016-1000346 · Nota
• https://access.redhat.com/errata/RHSA-2018:2669 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-1000341 · Nota
• https://debian.org/security/2018/dsa-4233 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1000613 · Nota
• https://suse.com/security/cve/CVE-2018-1000180 · Nota
• https://suse.com/security/cve/CVE-2016-1000342 · Nota
• https://oracle.com/security-alerts/cpuoct2020.html · Nota
• https://suse.com/security/cve/CVE-2016-1000343 · Nota
• https://osv.dev/vulnerability/CVE-2016-1000352 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20181127-0004 · Nota
• https://suse.com/security/cve/CVE-2016-1000338 · Nota
• https://github.com/advisories/GHSA-w285-wf9q-5w69 · Nota