PT-2018-4641 · Bouncy Castle+2 · Bouncy Castle Jce Provider+2

Published 2018-06-04 · Updated 2024-06-15 · CVE-2016-1000352

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions 1.55 and earlier

Description The issue concerns the use of ECB mode in the ECIES implementation, which is considered unsafe. Support for this mode has been removed due to its unsafe nature.

Recommendations For Bouncy Castle JCE Provider versions 1.55 and earlier, consider updating to a version where ECB mode support has been removed to mitigate the risk.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-310

Related Identifiers

CVE-2016-1000352

GHSA-W285-WF9Q-5W69

MGASA-2018-0376

OPENSUSE-SU-2018_1689-1

OPENSUSE-SU-2024:10661-1

RHSA-2018:2927

Affected Products

Bouncy Castle Jce Provider

Jira

Suse

References · 38

• https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f · Patch
• https://access.redhat.com/errata/RHSA-2018:2669 · Vendor Advisory
• https://debian.org/security/2018/dsa-4233 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1000352 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10661-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000352 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1000352 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2927 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-1000352 · Security Note
• https://ubuntu.com/security/CVE-2016-1000352 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0376.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1000352 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-1000352 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0376 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w285-wf9q-5w69 · Vendor Advisory