CVE-2016-1000344
HIGH7.4EPSS 0.39%In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode
發布日:2018/10/18修改日:2026/4/28
描述
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
受影響套件(4)
- Debian/bouncycastlefrom 0, < 1.56-1
- Maven/org.bouncycastle:bcprov-jdk14from 0, < 1.56
- Maven/org.bouncycastle:bcprov-jdk15from 0, < 1.56
- Maven/org.bouncycastle:bcprov-jdk15onfrom 0, < 1.56
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
參考連結(8)
- ADVISORYhttps://github.com/advisories/GHSA-2j2x-hx4g-2gf4
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-1000344
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2016-1000344
- WEBhttps://access.redhat.com/errata/RHSA-2018:2669
- WEBhttps://access.redhat.com/errata/RHSA-2018:2927
- WEBhttps://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f
- WEBhttps://security.netapp.com/advisory/ntap-20181127-0004
- WEBhttps://www.oracle.com/security-alerts/cpuoct2020.html