PT-2018-4637 · Bouncy Castle+3 · Bouncy Castle Jce Provider+3

Published 2018-06-04 · Updated 2025-05-12 · CVE-2016-1000343

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions 1.55 and earlier

Description The issue concerns the generation of weak private keys by the DSA key pair generator when used with default values. If the JCA key pair generator is not explicitly initialized with DSA parameters, it generates a private value assuming a 1024-bit key size. This can be mitigated by explicitly passing parameters to the key pair generator.

Recommendations For Bouncy Castle JCE Provider versions 1.55 and earlier, explicitly initialize the JCA key pair generator with DSA parameters to avoid generating weak private keys.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2016-1000343

DLA-1418-1

GHSA-RRVX-PWF8-P59P

MGASA-2018-0376

OPENSUSE-SU-2018_1689-1

OPENSUSE-SU-2024:10661-1

RHSA-2018:2927

USN-3727-1

Affected Products

Bouncy Castle Jce Provider

Jira

Suse

Ubuntu

References · 54

• https://github.com/bcgit/bc-java/commit/50a53068c094d6cff37659da33c9b4505becd389#diff-5578e61500abb2b87b300d3114bdfd7d · Patch
• https://ubuntu.com/security/notices/USN-3727-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-1000343 · Security Note
• https://access.redhat.com/errata/RHSA-2018:2669 · Vendor Advisory
• https://usn.ubuntu.com/3727-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000342 · Vendor Advisory
• https://debian.org/security/2018/dsa-4233 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1418-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3727-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000343 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10661-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000345 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rrvx-pwf8-p59p · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2927 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1000343 · Vendor Advisory