PT-2018-4638 · Bouncy Castle+2 · Bouncy Castle Jce Provider+2

Published 2018-06-04 · Updated 2025-05-12 · CVE-2016-1000344

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions 1.55 and earlier

Description The issue concerns the use of ECB mode in the DHIES implementation, which is considered unsafe. Support for this mode has been removed from the provider.

Recommendations For Bouncy Castle JCE Provider versions 1.55 and earlier, update to a version that no longer supports ECB mode in the DHIES implementation to resolve the issue.

Fix

Weakness Enumeration

CWE-1310

CWE-310

Related Identifiers

CVE-2016-1000344

GHSA-2J2X-HX4G-2GF4

MGASA-2018-0376

OPENSUSE-SU-2018_1689-1

OPENSUSE-SU-2024:10661-1

RHSA-2018:2927

Affected Products

Bouncy Castle Jce Provider

Jira

Suse

References · 64

• https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f · Patch
• https://ubuntu.com/security/CVE-2016-1000344 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2669 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1000344 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0376 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000344 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-1000344 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10661-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-1000344 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1000344 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2j2x-hx4g-2gf4 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2927 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1000344 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000344 · Security Note
• https://advisories.mageia.org/MGASA-2018-0376.html · Security Note