#VU13589 Cryptographic issues in The Bouncy Castle Crypto Package For Java - CVE-2016-1000341
Published: July 5, 2018
Vulnerability identifier: #VU13589
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-1000341
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
The Bouncy Castle Crypto Package For Java
The Bouncy Castle Crypto Package For Java
Software vendor:
Legion of the Bouncy Castle Inc.
Legion of the Bouncy Castle Inc.
Description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists in Bouncy Castle JCE Provider implementation of DSA signature generation process. The attacker with ability to observe timings for the generation of signatures can gain information about the signature's k value and ultimately the private value as well.
Remediation
Install updates from vendor's website.