#VU13587 Cryptographic issues in The Bouncy Castle Crypto Package For Java - CVE-2016-1000339

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU13587

#VU13587 Cryptographic issues in The Bouncy Castle Crypto Package For Java - CVE-2016-1000339

Published: July 5, 2018


Vulnerability identifier: #VU13587
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-1000339
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
The Bouncy Castle Crypto Package For Java
Software vendor:
Legion of the Bouncy Castle Inc.

Description

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability is present in Bouncy Castle JCE Provider due to usage of AESFastEngine that does not provide the sufficient level of secrecy and is prone to side-channel attacks. 



Remediation

Install updates from vendor's website.

External links