CVE-2016-1000338
CVE-2016-1000338
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
CVSS 7.5 · High · EPSS 1.8% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
bouncycastle Debian:12
- Affected ranges
- ECOSYSTEM: < 1.56-1
Update to 1.56-1
bouncycastle Debian:13
- Affected ranges
- ECOSYSTEM: < 1.56-1
Update to 1.56-1
bouncycastle Debian:14
- Affected ranges
- ECOSYSTEM: < 1.56-1
Update to 1.56-1
bouncycastle Ubuntu:14.04:LTS
- Versions
- 1.48+dfsg-2
- 1.49+dfsg-2
- Affected ranges
- ECOSYSTEM: < 1.49+dfsg-2ubuntu0.1
Update to 1.49+dfsg-2ubuntu0.1
bouncycastle Ubuntu:Pro:16.04:LTS
- Versions
- 1.49+dfsg-3ubuntu1
- 1.51-4ubuntu1
- 1.51-4ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
- https://access.redhat.com/errata/RHSA-2018:2669
- https://usn.ubuntu.com/3727-1/
- https://access.redhat.com/errata/RHSA-2018:2927
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0
- https://security.netapp.com/advisory/ntap-20231006-0011/
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000338