GHSA-2j2x-hx4g-2gf4

Source

https://github.com/advisories/GHSA-2j2x-hx4g-2gf4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-2j2x-hx4g-2gf4/GHSA-2j2x-hx4g-2gf4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2j2x-hx4g-2gf4

Aliases

CVE-2016-1000344

Published

2018-10-18T17:43:55Z

Modified

2024-02-16T08:20:45.756586Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode

Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-1310"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:52:17Z"
}

References

Affected packages

Maven / org.bouncycastle:bcprov-jdk14

Package

Name: org.bouncycastle:bcprov-jdk14; View open source insights on deps.dev
Purl: pkg:maven/org.bouncycastle/bcprov-jdk14

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.56

Affected versions

1.*

1.38

1.43

1.44

1.45

1.46

1.47

1.48

1.49

1.50

1.51

1.53

1.54

1.55

Maven / org.bouncycastle:bcprov-jdk15