CVE-2016-1000346
Bouncy Castle JCE Provider could allow a remote attacker to obtain sensitive information, caused by a flaw in the other party DH public key. A remote attacker could exploit this vulnerability to reveal details via invalid keys.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-1000346?
CVE-2016-1000346 is a vulnerability in the Bouncy Castle JCE Provider that could allow a remote attacker to obtain sensitive information.
How does CVE-2016-1000346 affect Bouncy Castle JCE Provider?
CVE-2016-1000346 affects Bouncy Castle JCE Provider versions 1.55 and earlier by not fully validating the other party DH public key, which can reveal details about the other party's private key in static Diffie-Hellman scenarios.
What is the severity of CVE-2016-1000346?
The severity of CVE-2016-1000346 is medium, with a CVSS score of 5.3.
How can I fix CVE-2016-1000346?
To fix CVE-2016-1000346, update Bouncy Castle JCE Provider to version 1.56 or later.
Where can I find more information about CVE-2016-1000346?
You can find more information about CVE-2016-1000346 in the references provided: [link1](https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1588328), [link3](https://access.redhat.com/security/updates/classification/).