In the Bouncy Castle JCE Provider version 1.55 and earlier...
Vulnerability Description
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-1000341
Credits & Attribution
No credits recorded in the NVD database.
References
- https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
- https://access.redhat.com/errata/RHSA-2018:2669
- https://usn.ubuntu.com/3727-1/
- https://access.redhat.com/errata/RHSA-2018:2927
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20181127-0004/
- https://github.com/bcgit/bc-java/commit/acaac81f96fec91ab45bd0412beaf9c3acd8defa#diff-e75226a9ca49217a7276b29242ec59ce
More from bouncycastle
View All →Affected Vendor
bouncycastle
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.