[MAVEN:GHSA-9GP4-QRFF-C648] Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

Severity Moderate

Affected Packages 2

Fixed Packages 2

CVEs 1

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.

Package	Affected Version
pkg:maven/org.bouncycastle/bcprov-jdk15	< 1.56
pkg:maven/org.bouncycastle/bcprov-jdk14	< 1.56

Package	Fixed Version
pkg:maven/org.bouncycastle/bcprov-jdk15	= 1.56
pkg:maven/org.bouncycastle/bcprov-jdk14	= 1.56

ID

MAVEN:GHSA-9GP4-QRFF-C648

Severity

moderate

URL

https://github.com/advisories/GHSA-9gp4-qrff-c648

Published

2018-10-18T18:04:13
(6 years ago)

Modified

2023-01-09T05:03:14
(20 months ago)

Rights

Maven Security Team

Other Advisories

USN-3727-1

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2016-1000345
			https://github.com/bcgit/bc-java/commit/21dcb3d9744c83dcf2ff8fcee06dbca7bfa4ef35#diff-4439ce586bf9a13bfec05c0d113b8098
			https://access.redhat.com/errata/RHSA-2018:2669
			https://access.redhat.com/errata/RHSA-2018:2927
			https://github.com/advisories/GHSA-9gp4-qrff-c648
			https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
			https://security.netapp.com/advisory/ntap-20181127-0004/
			https://usn.ubuntu.com/3727-1/
			https://www.oracle.com/security-alerts/cpuoct2020.html

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.bouncycastle/bcprov-jdk15	org.bouncycastle	bcprov-jdk15	< 1.56
Fixed	pkg:maven/org.bouncycastle/bcprov-jdk15	org.bouncycastle	bcprov-jdk15	= 1.56
Affected	pkg:maven/org.bouncycastle/bcprov-jdk14	org.bouncycastle	bcprov-jdk14	< 1.56
Fixed	pkg:maven/org.bouncycastle/bcprov-jdk14	org.bouncycastle	bcprov-jdk14	= 1.56

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date