CVSS 3.0
5.9 mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2016-1000345
Medium (5.9). EPSS 2.6% chance of exploitation in the next 30 days. Fixed in org.bouncycastle:bcprov-jdk14 1.56.
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
Severity
- EPSS
- 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-361
- Published
- Modified
- Record from
- the NVD, synced
Affected
- bouncycastle:bc-java
- debian:debian_linux
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9gp4-qrff-c648 | Maven | org.bouncycastle:bcprov-jdk14 | <1.56 | 1.56 |
| GHSA-9gp4-qrff-c648 | Maven | org.bouncycastle:bcprov-jdk15 | <1.56 | 1.56 |
| GHSA-9gp4-qrff-c648 | Maven | org.bouncycastle:bcprov-jdk15on | <1.56 | 1.56 |
References
- https://access.redhat.com/errata/RHSA-2018:2669
- https://access.redhat.com/errata/RHSA-2018:2927
- https://github.com/bcgit/bc-java/commit/21dcb3d9744c83dcf2ff8fcee06dbca7bfa4ef35#diff-4439ce586bf9a13bfec05c0d113b8098
- https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
- https://security.netapp.com/advisory/ntap-20181127-0004/