← Back

CVE-2016-1000338

nvd nist
Published: Jun 1, 2018Modified: May 5, 2025

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Affected (5)

Show all products
Bouncycastle: Legion Of The Bouncy Castle Java Crytography Api · Canonical: Ubuntu Linux · Redhat: Satellite, Satellite Capsule · Netapp: 7 Mode Transition Tool
Bouncycastle
1 product
Legion Of The Bouncy Castle Java Crytography Api
Canonical
1 product
Ubuntu Linux
Redhat
2 products
Satellite
Satellite Capsule
Netapp
1 product
7 Mode Transition Tool
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Legion Of The Bouncy Castle Java Crytography Api
From 1.38 to 1.56
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Ubuntu Linux
Version 14.04
Satellite
Version 6.4
Satellite Capsule
Version 6.4
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
7 Mode Transition Tool
All versions

Related CWEs

CWE-347
Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (16)

Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.