CVE-2016-1000338
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1000338?
The severity of CVE-2016-1000338 is high, with a CVSS score of 7.5.
How does CVE-2016-1000338 affect Bouncy Castle JCE Provider?
CVE-2016-1000338 affects Bouncy Castle JCE Provider versions 1.55 and earlier.
What is the impact of CVE-2016-1000338?
The impact of CVE-2016-1000338 is that it could provide weaker than expected security due to improper validation of ASN.1 encoding, allowing the injection of extra elements in the signature.
How can I fix CVE-2016-1000338?
To fix CVE-2016-1000338, update Bouncy Castle JCE Provider to version 1.56 or later.
Are there any references for more information about CVE-2016-1000338?
Yes, you can find more information about CVE-2016-1000338 at the following references: - NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-1000338 - GitHub Commit: https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0 - Red Hat Advisory: https://access.redhat.com/errata/RHSA-2018:2669