PT-2018-4635 · Bouncy Castle+3 · Bouncy Castle Jce Provider+3

Published 2018-06-04 · Updated 2025-05-12 · CVE-2016-1000341

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions 1.55 and earlier

Description The issue concerns a timing attack vulnerability in DSA signature generation. When timings can be closely observed for the generation of signatures, the lack of blinding may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

Recommendations For Bouncy Castle JCE Provider versions 1.55 and earlier, consider updating to a version that includes blinding in DSA signature generation to prevent timing attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-361

Related Identifiers

CVE-2016-1000341

DLA-1418-1

GHSA-R9CH-M4FH-FC7Q

MGASA-2018-0376

OPENSUSE-SU-2018_1689-1

OPENSUSE-SU-2024:10661-1

RHSA-2018:2927

USN-3727-1

Affected Products

Bouncy Castle Jce Provider

Jira

Suse

Ubuntu

References · 52

• https://github.com/bcgit/bc-java/commit/acaac81f96fec91ab45bd0412beaf9c3acd8defa#diff-e75226a9ca49217a7276b29242ec59ce · Patch
• https://ubuntu.com/security/notices/USN-3727-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2669 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000342 · Vendor Advisory
• https://usn.ubuntu.com/3727-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4233 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1418-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1000341 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3727-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000341 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-1000341 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10661-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000345 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2927 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000339 · Vendor Advisory