In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode

HIGH 7.4CVE-2016-1000352 · GHSA-w285-wf9q-5w69 · Published 04/06/2018 · updated 17/06/2026

In short

CVE-2016-1000352 is a HIGH (CVSS 7.4) vulnerability affecting org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15, org.bouncycastle:bcprov-jdk15on.
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.3% of all vulnerabilities.
Fix: update to 1.56 or later.

Package	Affected versions	Patched versions
org.bouncycastle:bcprov-jdk14 Maven	`< 1.56`	`1.56`
org.bouncycastle:bcprov-jdk15 Maven	`< 1.56`	`1.56`
org.bouncycastle:bcprov-jdk15on Maven	`< 1.56`	`1.56`
bc-java bouncycastle	`≤ 1.55`	No fix yet

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

NVD description

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

References

nvd.nist.gov/vuln/detail/CVE-2016-1000352 · ADVISORY
bcgit/bc-java commit 9385b0e · WEB
access.redhat.com/errata/RHSA-2018:2669 · WEB
access.redhat.com/errata/RHSA-2018:2927 · WEB
GitHub Advisory GHSA-w285-wf9q-5w69 · ADVISORY
bcgit/bc-java · PACKAGE
security.netapp.com/advisory/ntap-20181127-0004 · WEB
oracle.com/security-alerts/cpuoct2020.html · WEB
security.netapp.com/advisory/ntap-20181127-0004

More vulnerabilities in org.bouncycastle:bcprov-jdk14

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.bouncycastle:bcprov-jdk14

Maven

< 1.56

1.56

org.bouncycastle:bcprov-jdk15

Maven

< 1.56

1.56

org.bouncycastle:bcprov-jdk15on

Maven

< 1.56

1.56

bc-java

bouncycastle

≤ 1.55

No fix yet

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

NVD description

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

More vulnerabilities in org.bouncycastle:bcprov-jdk14

See all →