Executive brief
In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification
Affected products
- Maven org.bouncycastle:bcprov-jdk14
- Maven org.bouncycastle:bcprov-jdk15on
- Maven org.bouncycastle:bcprov-jdk15
Junglewise Threat Intelligence
CVE-2016-1000342: In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification
CVE-2016-1000342 · Severity: low · CVSS 3 · Published 2018-10-17
Technologies: org.bouncycastle:bcprov-jdk14 (Maven), org.bouncycastle:bcprov-jdk15on (Maven), org.bouncycastle:bcprov-jdk15 (Maven). Vendors: Maven.
Related threats
- Bouncy Castle BC-JAVA timing channel in FrodoKEM
- Bouncy Castle BC-JAVA LDAP injection in LDAPStoreHelper
- Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
- Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
- Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")