CVSS 3.0
7.4 highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2016-1000352
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Severity
- EPSS
- 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- bouncycastle:bc-java
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w285-wf9q-5w69 | Maven | org.bouncycastle:bcprov-jdk14 | <1.56 | 1.56 |
| GHSA-w285-wf9q-5w69 | Maven | org.bouncycastle:bcprov-jdk15 | <1.56 | 1.56 |
| GHSA-w285-wf9q-5w69 | Maven | org.bouncycastle:bcprov-jdk15on | <1.56 | 1.56 |