Executive brief
In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode
Affected products
- Maven org.bouncycastle:bcprov-jdk14
- Maven org.bouncycastle:bcprov-jdk15on
- Maven org.bouncycastle:bcprov-jdk15
Junglewise Threat Intelligence
CVE-2016-1000344: In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode
CVE-2016-1000344 · Severity: low · CVSS 3 · Published 2018-10-18
Technologies: org.bouncycastle:bcprov-jdk14 (Maven), org.bouncycastle:bcprov-jdk15on (Maven), org.bouncycastle:bcprov-jdk15 (Maven). Vendors: Maven.
Related threats
- Bouncy Castle BC-JAVA timing channel in FrodoKEM
- Bouncy Castle BC-JAVA LDAP injection in LDAPStoreHelper
- Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
- Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
- Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")