CVE-2016-1000346

bouncycastle: Other party DH public keys are not fully validated

Published Jun 4, 2018 CVSS 3.0 · 3.7 Low EPSS 2.1% KEV · Not listed
Description
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-1418-1 bouncycastle security update
EUVD EUVD EUVD-2018-0591 In Bouncy Castle JCE Provider the other party DH public key is not fully validated
Github GHSA Github GHSA GHSA-fjqm-246c-mwqg In Bouncy Castle JCE Provider the other party DH public key is not fully validated
Ubuntu USN Ubuntu USN USN-3727-1 Bouncy Castle vulnerabilities
History
Type Values Removed Values Added
First Time appeared Bouncycastle bc-java
CPEs cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:*:*:*:*:*:*:*:* cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*
Vendors & Products Bouncycastle legion-of-the-bouncy-castle-java-crytography-api
Bouncycastle bc-java
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 6, 2024, 3:55 AM
Reserved
Jun 4, 2018, 12:00 AM
Status
Modified
Published
Jun 4, 2018, 9:29 PM
Modified
Jun 17, 2026, 12:38 AM
Severity
Moderate
Public date
Oct 29, 2016, 12:00 AM