CVE-2016-1000343
CVE-2016-1000343
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
CVSS 7.5 · High · EPSS 3.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
bouncycastle Debian:12
- Affected ranges
- ECOSYSTEM: < 1.56-1
Update to 1.56-1
bouncycastle Debian:13
- Affected ranges
- ECOSYSTEM: < 1.56-1
Update to 1.56-1
bouncycastle Debian:14
- Affected ranges
- ECOSYSTEM: < 1.56-1
Update to 1.56-1
bouncycastle Ubuntu:14.04:LTS
- Versions
- 1.48+dfsg-2
- 1.49+dfsg-2
- Affected ranges
- ECOSYSTEM: < 1.49+dfsg-2ubuntu0.1
Update to 1.49+dfsg-2ubuntu0.1
bouncycastle Ubuntu:Pro:16.04:LTS
- Versions
- 1.49+dfsg-3ubuntu1
- 1.51-4ubuntu1
- 1.51-4ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
- https://access.redhat.com/errata/RHSA-2018:2669
- https://usn.ubuntu.com/3727-1/
- https://access.redhat.com/errata/RHSA-2018:2927
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20181127-0004/
- https://github.com/bcgit/bc-java/commit/50a53068c094d6cff37659da33c9b4505becd389#diff-5578e61500abb2b87b300d3114bdfd7d
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000343