PT-2018-4640 · Bouncy Castle+3 · Bouncy Castle Jce Provider+3

Published 2018-06-04 · Updated 2024-06-15 · CVE-2016-1000346

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions prior to 1.56

Description The issue arises from insufficient validation of the other party's Diffie-Hellman public key, potentially allowing invalid keys to reveal details about the other party's private key when static Diffie-Hellman is used.

Recommendations For Bouncy Castle JCE Provider versions prior to 1.56, update to version 1.56 or later, where key parameters are checked during agreement calculation to resolve the issue.

Fix

Weakness Enumeration

CWE-320

Related Identifiers

CVE-2016-1000346

DLA-1418-1

GHSA-FJQM-246C-MWQG

MGASA-2018-0376

OPENSUSE-SU-2018_1689-1

OPENSUSE-SU-2024:10661-1

RHSA-2018:2927

USN-3727-1

Affected Products

Bouncy Castle Jce Provider

Jira

Suse

Ubuntu

References · 51

• https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937 · Patch
• https://ubuntu.com/security/notices/USN-3727-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2669 · Vendor Advisory
• https://usn.ubuntu.com/3727-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000342 · Vendor Advisory
• https://debian.org/security/2018/dsa-4233 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1418-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fjqm-246c-mwqg · Vendor Advisory
• https://osv.dev/vulnerability/USN-3727-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1000346 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-1000346 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10661-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000345 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2927 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1000339 · Vendor Advisory