CVE-2016-1000352: High severity bouncy castle crypto package vulnerability
Published Jun 4, 2018
·Updated
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Affected Software
3 affected componentsFixes available
redhat/bouncycastle<1.56
1.56
bouncycastle Legion-of-the-bouncy-castle-java-crytography-api<=1.55
bouncycastle bc-java<=1.55
Remediation
Event History
Jun 4, 2018
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2016-1000352?
CVE-2016-1000352 is a vulnerability in the Bouncy Castle JCE Provider version 1.55 and earlier that allowed for the use of ECB mode, which is regarded as unsafe.
2
How severe is CVE-2016-1000352?
CVE-2016-1000352 has a severity rating of 7.4 (high).
3
How can I fix CVE-2016-1000352?
To fix CVE-2016-1000352, update the Bouncy Castle JCE Provider to version 1.56 or later.
4
What is the affected software for CVE-2016-1000352?
The affected software for CVE-2016-1000352 includes Bouncy Castle JCE Provider version 1.55 and earlier.
5
What is the Common Weakness Enumeration (CWE) ID for CVE-2016-1000352?
The CWE ID for CVE-2016-1000352 is CWE-310.