[MAVEN:GHSA-FJQM-246C-MWQG] In Bouncy Castle JCE Provider the other party DH public key is not fully validated

Severity Low

Affected Packages 2

Fixed Packages 2

CVEs 1

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

Package	Affected Version
pkg:maven/org.bouncycastle/bcprov-jdk15	< 1.56
pkg:maven/org.bouncycastle/bcprov-jdk14	< 1.56

Package	Fixed Version
pkg:maven/org.bouncycastle/bcprov-jdk15	= 1.56
pkg:maven/org.bouncycastle/bcprov-jdk14	= 1.56

ID

MAVEN:GHSA-FJQM-246C-MWQG

Severity

low

URL

https://github.com/advisories/GHSA-fjqm-246c-mwqg

Published

2018-10-17T16:27:28
(6 years ago)

Modified

2023-01-09T05:02:53
(20 months ago)

Rights

Maven Security Team

Other Advisories

USN-3727-1

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2016-1000346
			https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937
			https://access.redhat.com/errata/RHSA-2018:2669
			https://access.redhat.com/errata/RHSA-2018:2927
			https://github.com/advisories/GHSA-fjqm-246c-mwqg
			https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
			https://security.netapp.com/advisory/ntap-20181127-0004/
			https://usn.ubuntu.com/3727-1/
			https://www.oracle.com/security-alerts/cpuoct2020.html

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.bouncycastle/bcprov-jdk15	org.bouncycastle	bcprov-jdk15	< 1.56
Fixed	pkg:maven/org.bouncycastle/bcprov-jdk15	org.bouncycastle	bcprov-jdk15	= 1.56
Affected	pkg:maven/org.bouncycastle/bcprov-jdk14	org.bouncycastle	bcprov-jdk14	< 1.56
Fixed	pkg:maven/org.bouncycastle/bcprov-jdk14	org.bouncycastle	bcprov-jdk14	= 1.56

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date