CVE-2016-1000345
CVE-2016-1000345
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
CVSS 5.9 · Medium · EPSS 2.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
bouncycastle Debian:12
- Affected ranges
- ECOSYSTEM: < 1.56-1
Update to 1.56-1
bouncycastle Debian:13
- Affected ranges
- ECOSYSTEM: < 1.56-1
Update to 1.56-1
bouncycastle Debian:14
- Affected ranges
- ECOSYSTEM: < 1.56-1
Update to 1.56-1
bouncycastle Ubuntu:14.04:LTS
- Versions
- 1.48+dfsg-2
- 1.49+dfsg-2
- Affected ranges
- ECOSYSTEM: < 1.49+dfsg-2ubuntu0.1
Update to 1.49+dfsg-2ubuntu0.1
bouncycastle Ubuntu:Pro:16.04:LTS
- Versions
- 1.49+dfsg-3ubuntu1
- 1.51-4ubuntu1
- 1.51-4ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
- https://access.redhat.com/errata/RHSA-2018:2669
- https://usn.ubuntu.com/3727-1/
- https://access.redhat.com/errata/RHSA-2018:2927
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20181127-0004/
- https://github.com/bcgit/bc-java/commit/21dcb3d9744c83dcf2ff8fcee06dbca7bfa4ef35#diff-4439ce586bf9a13bfec05c0d113b8098
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000345