CVE-2016-1000352
HIGH7.4EPSS 0.39%In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode
發布日:2018/10/17修改日:2026/4/28
也稱為:DEBIAN-CVE-2016-1000352
描述
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
受影響套件(4)
- Debian/bouncycastlefrom 0, < 1.56-1
- Maven/org.bouncycastle:bcprov-jdk14from 0, < 1.56
- Maven/org.bouncycastle:bcprov-jdk15from 0, < 1.56
- Maven/org.bouncycastle:bcprov-jdk15onfrom 0, < 1.56
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
參考連結(9)
- ADVISORYhttps://github.com/advisories/GHSA-w285-wf9q-5w69
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-1000352
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2016-1000352
- PATCHhttps://github.com/bcgit/bc-java
- WEBhttps://access.redhat.com/errata/RHSA-2018:2669
- WEBhttps://access.redhat.com/errata/RHSA-2018:2927
- WEBhttps://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f
- WEBhttps://security.netapp.com/advisory/ntap-20181127-0004
- WEBhttps://www.oracle.com/security-alerts/cpuoct2020.html