CVE-2016-1000352
First published: Mon Jun 04 2018(Updated: )
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bouncycastle Legion-of-the-bouncy-castle-java-crytography-api | <=1.55 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2018:2669
- https://access.redhat.com/errata/RHSA-2018:2927
- https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f
- https://security.netapp.com/advisory/ntap-20181127-0004/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1588331
- https://access.redhat.com/security/updates/classification/
- https://bugzilla.redhat.com/show_bug.cgi?id=1588330
Frequently Asked Questions
What is CVE-2016-1000352?
CVE-2016-1000352 is a vulnerability in the Bouncy Castle JCE Provider version 1.55 and earlier that allowed for the use of ECB mode, which is regarded as unsafe.
How severe is CVE-2016-1000352?
CVE-2016-1000352 has a severity rating of 7.4 (high).
How can I fix CVE-2016-1000352?
To fix CVE-2016-1000352, update the Bouncy Castle JCE Provider to version 1.56 or later.
What is the affected software for CVE-2016-1000352?
The affected software for CVE-2016-1000352 includes Bouncy Castle JCE Provider version 1.55 and earlier.
What is the Common Weakness Enumeration (CWE) ID for CVE-2016-1000352?
The CWE ID for CVE-2016-1000352 is CWE-310.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-1000352
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/bouncycastle
- canonical/bouncycastle legion-of-the-bouncy-castle-java-crytography-api
- version/bouncycastle legion-of-the-bouncy-castle-java-crytography-api/1.55
- package-manager/redhat