CVE-2016-1000346: In Bouncy Castle JCE Provider the other… – CVSS 3.7 · Watchpost

← 脆弱性一覧

In Bouncy Castle JCE Provider the other party DH public key is not fully validated

低 3.7CVE-2016-1000346 · GHSA-fjqm-246c-mwqg · 04/06/2018 公開 · 17/06/2026 更新

要点

CVE-2016-1000346 は org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15, org.bouncycastle:bcprov-jdk15on に影響する深刻度「低」 (CVSS 3.7) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.2%（全脆弱性の 82.3% より高い）。
対処：1.56 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.bouncycastle:bcprov-jdk14 Maven	`< 1.56`	`1.56`
org.bouncycastle:bcprov-jdk15 Maven	`< 1.56`	`1.56`
org.bouncycastle:bcprov-jdk15on Maven	`< 1.56`	`1.56`
bc-java bouncycastle	`≤ 1.55`	修正版なし

概要

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

NVD の説明

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

参考情報

nvd.nist.gov/vuln/detail/CVE-2016-1000346 · ADVISORY
bcgit/bc-java commit 1127131 · WEB
access.redhat.com/errata/RHSA-2018:2669 · WEB
access.redhat.com/errata/RHSA-2018:2927 · WEB
GitHub Advisory GHSA-fjqm-246c-mwqg · ADVISORY
bcgit/bc-java · PACKAGE
lists.debian.org/debian-lts-announce/2018/07/msg00009.html · WEB
security.netapp.com/advisory/ntap-20181127-0004 · WEB
usn.ubuntu.com/3727-1 · WEB
oracle.com/security-alerts/cpuoct2020.html · WEB
security.netapp.com/advisory/ntap-20181127-0004
usn.ubuntu.com/3727-1

org.bouncycastle:bcprov-jdk14 のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン