CVE-2016-1000344: High severity bouncy castle crypto package vulnerability
Bouncy Castle JCE Provider could provide weaker than expected security, caused by a flaw in the DHIES implementation. A remote attacker could exploit this vulnerability to launch further attacks on the system.
Other sources
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-1000344?
CVE-2016-1000344 is a vulnerability in the Bouncy Castle JCE Provider version 1.55 and earlier, which allows for weaker security in the DHIES implementation.
How does CVE-2016-1000344 affect Bouncy Castle JCE Provider?
CVE-2016-1000344 affects Bouncy Castle JCE Provider by enabling a remote attacker to launch additional attacks on the system.
What is the severity of CVE-2016-1000344?
CVE-2016-1000344 has a severity rating of 7.4 (high).
Which software versions are affected by CVE-2016-1000344?
CVE-2016-1000344 affects Bouncy Castle JCE Provider versions 1.55 and earlier, IBM GDE up to version 3.0.0.2, and Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api up to version 1.55.
How can I fix CVE-2016-1000344?
To fix CVE-2016-1000344, update Bouncy Castle JCE Provider to version 1.56 or later.