[MAVEN:GHSA-4VHJ-98R6-424H] In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate

Severity High

Affected Packages 2

Fixed Packages 2

CVEs 1

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Package	Affected Version
pkg:maven/org.bouncycastle/bcprov-jdk15	< 1.5.6
pkg:maven/org.bouncycastle/bcprov-jdk14	< 1.56

Package	Fixed Version
pkg:maven/org.bouncycastle/bcprov-jdk15	= 1.5.6
pkg:maven/org.bouncycastle/bcprov-jdk14	= 1.56

ID

MAVEN:GHSA-4VHJ-98R6-424H

Severity

high

URL

https://github.com/advisories/GHSA-4vhj-98r6-424h

Published

2018-10-17T16:23:26
(6 years ago)

Modified

2023-11-10T05:00:48
(10 months ago)

Rights

Maven Security Team

Other Advisories

USN-3727-1

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2016-1000338
			https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0
			https://access.redhat.com/errata/RHSA-2018:2669
			https://access.redhat.com/errata/RHSA-2018:2927
			https://github.com/advisories/GHSA-4vhj-98r6-424h
			https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
			https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
			https://usn.ubuntu.com/3727-1/
			https://www.oracle.com/security-alerts/cpuoct2020.html
			https://security.netapp.com/advisory/ntap-20231006-0011/

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.bouncycastle/bcprov-jdk15	org.bouncycastle	bcprov-jdk15	< 1.5.6
Fixed	pkg:maven/org.bouncycastle/bcprov-jdk15	org.bouncycastle	bcprov-jdk15	= 1.5.6
Affected	pkg:maven/org.bouncycastle/bcprov-jdk14	org.bouncycastle	bcprov-jdk14	< 1.56
Fixed	pkg:maven/org.bouncycastle/bcprov-jdk14	org.bouncycastle	bcprov-jdk14	= 1.56

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date