CVE-2016-1000338

CWE-347CWE-32512 documents8 sources
Severity
7.5HIGH
EPSS
0.4%
top 41.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Bouncycastle Legion-of-the-bouncy-castle-java-crytography-apiCanonical Ubuntu LinuxRedhat Satellite+1 more
Timeline
PublishedJun 1
Latest updateOct 17

Description

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages7 packages

▶Mavenorg.bouncycastle:bcprov-jdk141.38 — 1.56
▶Mavenorg.bouncycastle:bcprov-jdk151.38 — 1.56
▶Mavenorg.bouncycastle:bcprov-jdk15on1.38 — 1.56
▶Debianbouncycastle< 1.56-1+3

Also affects: Ubuntu Linux 14.04

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate↗2018-10-17
▶
OSV
In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate↗2018-10-17
▶
OSV
CVE-2016-1000338: In Bouncy Castle JCE Provider version 1↗2018-06-01
▶
CVEList
CVE-2016-1000338: In Bouncy Castle JCE Provider version 1↗2018-06-01
▶

📋Vendor Advisories

3
Ubuntu
Bouncy Castle vulnerabilities↗2018-08-01
▶
Red Hat
bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data↗2016-10-15
▶
Debian
CVE-2016-1000338: bouncycastle - In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully va...↗2016
▶

💬Community

4
Bugzilla
CVE-2016-1000338 bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data [epel-all]↗2018-06-07
▶
Bugzilla
CVE-2016-1000338 bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data [fedora-all]↗2018-06-07
▶
Bugzilla
CVE-2016-1000338 bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data [epel-6]↗2018-06-07
▶
Bugzilla
CVE-2016-1000338 bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data↗2018-06-07
▶