Junglewise Threat Intelligence
CVE-2016-1000338: In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate
CVE-2016-1000338 · Severity: low · CVSS 3.1 · Published 2018-10-17
Technologies: org.bouncycastle:bcprov-jdk14 (Maven), org.bouncycastle:bcprov-jdk15on (Maven), org.bouncycastle:bcprov-jdk15 (Maven). Vendors: Maven.
Executive brief
In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate
Affected products
- Maven org.bouncycastle:bcprov-jdk14
- Maven org.bouncycastle:bcprov-jdk15on
- Maven org.bouncycastle:bcprov-jdk15