CVE-2016-1000344
First published: Mon Jun 04 2018(Updated: )
Bouncy Castle JCE Provider could provide weaker than expected security, caused by a flaw in the DHIES implementation. A remote attacker could exploit this vulnerability to launch further attacks on the system.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM GDE | <=3.0.0.2 | |
| Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api | <=1.55 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/151809
- https://www.ibm.com/support/pages/node/6320835 (Advisory)
- https://access.redhat.com/errata/RHSA-2018:2669
- https://access.redhat.com/errata/RHSA-2018:2927
- https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f
- https://security.netapp.com/advisory/ntap-20181127-0004/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1588321
- https://access.redhat.com/security/updates/classification/
- https://bugzilla.redhat.com/show_bug.cgi?id=1588314
Frequently Asked Questions
What is CVE-2016-1000344?
CVE-2016-1000344 is a vulnerability in the Bouncy Castle JCE Provider version 1.55 and earlier, which allows for weaker security in the DHIES implementation.
How does CVE-2016-1000344 affect Bouncy Castle JCE Provider?
CVE-2016-1000344 affects Bouncy Castle JCE Provider by enabling a remote attacker to launch additional attacks on the system.
What is the severity of CVE-2016-1000344?
CVE-2016-1000344 has a severity rating of 7.4 (high).
Which software versions are affected by CVE-2016-1000344?
CVE-2016-1000344 affects Bouncy Castle JCE Provider versions 1.55 and earlier, IBM GDE up to version 3.0.0.2, and Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api up to version 1.55.
How can I fix CVE-2016-1000344?
To fix CVE-2016-1000344, update Bouncy Castle JCE Provider to version 1.56 or later.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/references
- agent/remedy
- agent/severity
- agent/weakness
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-1000344
- agent/software-canonical-lookup
- agent/event
- collector/ibm-support
- source/IBM
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/bouncycastle
- canonical/bouncycastle legion-of-the-bouncy-castle-java-crytography-api
- version/bouncycastle legion-of-the-bouncy-castle-java-crytography-api/1.55
- package-manager/redhat
- vendor/ibm
- canonical/ibm gde
- version/ibm gde/3.0.0.2