p PatchFirst

CVE-2016-1000341

CVE-2016-1000341

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

CVSS 5.9 · Medium · EPSS 2.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • bouncycastle Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.56-1

    Update to 1.56-1

  • bouncycastle Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.56-1

    Update to 1.56-1

  • bouncycastle Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.56-1

    Update to 1.56-1

  • bouncycastle Ubuntu:14.04:LTS

    Versions
    • 1.48+dfsg-2
    • 1.49+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 1.49+dfsg-2ubuntu0.1

    Update to 1.49+dfsg-2ubuntu0.1

  • bouncycastle Ubuntu:Pro:16.04:LTS

    Versions
    • 1.49+dfsg-3ubuntu1
    • 1.51-4ubuntu1
    • 1.51-4ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →