CVE-2016-1000346: Medium severity bouncycastle Legion-of-the-bouncy-castle-java-crytography-api vulnerability
Bouncy Castle JCE Provider could allow a remote attacker to obtain sensitive information, caused by a flaw in the other party DH public key. A remote attacker could exploit this vulnerability to reveal details via invalid keys.
Other sources
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-1000346?
CVE-2016-1000346 is a vulnerability in the Bouncy Castle JCE Provider that could allow a remote attacker to obtain sensitive information.
How does CVE-2016-1000346 affect Bouncy Castle JCE Provider?
CVE-2016-1000346 affects Bouncy Castle JCE Provider versions 1.55 and earlier by not fully validating the other party DH public key, which can reveal details about the other party's private key in static Diffie-Hellman scenarios.
What is the severity of CVE-2016-1000346?
The severity of CVE-2016-1000346 is medium, with a CVSS score of 5.3.
How can I fix CVE-2016-1000346?
To fix CVE-2016-1000346, update Bouncy Castle JCE Provider to version 1.56 or later.
Where can I find more information about CVE-2016-1000346?
You can find more information about CVE-2016-1000346 in the references provided: [link1](https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1588328), [link3](https://access.redhat.com/security/updates/classification/).