CVE-2016-1000345

CWE-361CWE-32510 documents8 sources
Severity
5.9MEDIUM
EPSS
0.8%
top 25.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Bouncycastle Bc-javaDebian Debian Linux
Timeline
PublishedJun 4
Latest updateOct 18

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages5 packages

▶Debianbouncycastle< 1.56-1+3

Also affects: Debian Linux 8.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15↗2018-10-18
▶
OSV
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15↗2018-10-18
▶
CVEList
CVE-2016-1000345: In the Bouncy Castle JCE Provider version 1↗2018-06-04
▶
OSV
CVE-2016-1000345: In the Bouncy Castle JCE Provider version 1↗2018-06-04
▶

📋Vendor Advisories

3
Ubuntu
Bouncy Castle vulnerabilities↗2018-08-01
▶
Red Hat
bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack↗2016-04-27
▶
Debian
CVE-2016-1000345: bouncycastle - In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC m...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-1000345 bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack [epel-6]↗2018-06-07
▶
Bugzilla
CVE-2016-1000345 bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack↗2018-06-07
▶
CVE-2016-1000345 (MEDIUM CVSS 5.9) | In the Bouncy Castle JCE Provider v | cvebase.io