Cryptographic issues in The Bouncy Castle Crypto Package For Java - CVE-2016-1000339

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU13587

Cryptographic issues in The Bouncy Castle Crypto Package For Java - CVE-2016-1000339

Published: July 5, 2018


Vulnerability identifier: #VU13587
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-1000339
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Legion of the Bouncy Castle Inc.
Affected software:
The Bouncy Castle Crypto Package For Java

Detailed vulnerability description

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability is present in Bouncy Castle JCE Provider due to usage of AESFastEngine that does not provide the sufficient level of secrecy and is prone to side-channel attacks. 



How to mitigate CVE-2016-1000339

Install updates from vendor's website.

Sources