Cryptographic issues in Bouncy Castle for Java - CVE-2016-1000339

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU13587

Cryptographic issues in Bouncy Castle for Java - CVE-2016-1000339

Published: July 5, 2018


Vulnerability identifier: #VU13587
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-1000339
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability is present in Bouncy Castle JCE Provider due to usage of AESFastEngine that does not provide the sufficient level of secrecy and is prone to side-channel attacks. 



Affected software

Bouncy Castle for Java
IBM Sterling File Gateway
Fuse
IBM Cloud Application Performance Management (APM)

How to mitigate CVE-2016-1000339

Install updates from vendor's website.

IBM Sterling File Gateway - addressed in versions 6.0.3.7, 6.1.0.5, 6.1.1.2, 6.1.2.0
Fuse - update to 7.1.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14

External References

Related Security Bulletins