GHSA-r9ch-m4fh-fc7q

Source

https://github.com/advisories/GHSA-r9ch-m4fh-fc7q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-r9ch-m4fh-fc7q/GHSA-r9ch-m4fh-fc7q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r9ch-m4fh-fc7q

Aliases

CVE-2016-1000341

Published

2018-10-17T16:24:00Z

Modified

2024-12-02T05:45:10.781887Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

Details

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:54:15Z"
}

References

Affected packages

Maven / org.bouncycastle:bcprov-jdk14

Package

Name: org.bouncycastle:bcprov-jdk14; View open source insights on deps.dev
Purl: pkg:maven/org.bouncycastle/bcprov-jdk14

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.56

Affected versions

1.*

1.38

1.43

1.44

1.45

1.46

1.47

1.48

1.49

1.50

1.51

1.53

1.54

1.55

Maven / org.bouncycastle:bcprov-jdk15