CVE-2016-1000346

Reference Links

• https://access.redhat.com/errata/RHSA-2018:2669
• https://access.redhat.com/errata/RHSA-2018:2927
• https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937
• https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
• https://security.netapp.com/advisory/ntap-20181127-0004/
• https://usn.ubuntu.com/3727-1/
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://launchpad.net/bugs/cve/CVE-2016-1000346
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1588328
• https://access.redhat.com/security/updates/classification/
• https://bugzilla.redhat.com/show_bug.cgi?id=1588327
• https://security-tracker.debian.org/tracker/CVE-2016-1000346
• https://exchange.xforce.ibmcloud.com/vulnerabilities/151807
• https://www.ibm.com/support/pages/node/6320835 (Advisory)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000346
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000346
• https://ubuntu.com/security/CVE-2016-1000346

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6320835

Frequently Asked Questions

• What is CVE-2016-1000346?

  CVE-2016-1000346 is a vulnerability in the Bouncy Castle JCE Provider that could allow a remote attacker to obtain sensitive information.

• How does CVE-2016-1000346 affect Bouncy Castle JCE Provider?

  CVE-2016-1000346 affects Bouncy Castle JCE Provider versions 1.55 and earlier by not fully validating the other party DH public key, which can reveal details about the other party's private key in static Diffie-Hellman scenarios.

• What is the severity of CVE-2016-1000346?

  The severity of CVE-2016-1000346 is medium, with a CVSS score of 5.3.

• How can I fix CVE-2016-1000346?

  To fix CVE-2016-1000346, update Bouncy Castle JCE Provider to version 1.56 or later.

• Where can I find more information about CVE-2016-1000346?

  You can find more information about CVE-2016-1000346 in the references provided: [link1](https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1588328), [link3](https://access.redhat.com/security/updates/classification/).