ghsa-rrvx-pwf8-p59p
Vulnerability from github
Published
2018-10-17 16:24
Modified
2022-04-27 13:29
Severity ?
Summary
In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values
Details
In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-jdk14" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.56" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "Maven", "name": "org.bouncycastle:bcprov-jdk15" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "1.56" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2016-1000343" ], "database_specific": { "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2020-06-16T21:55:50Z", "nvd_published_at": null, "severity": "HIGH" }, "details": "In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.", "id": "GHSA-rrvx-pwf8-p59p", "modified": "2022-04-27T13:29:11Z", "published": "2018-10-17T16:24:22Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000343" }, { "type": "WEB", "url": "https://github.com/bcgit/bc-java/commit/50a53068c094d6cff37659da33c9b4505becd389#diff-5578e61500abb2b87b300d3114bdfd7d" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2018:2669" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2018:2927" }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-rrvx-pwf8-p59p" }, { "type": "PACKAGE", "url": "https://github.com/bcgit/bc-java" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20181127-0004" }, { "type": "WEB", "url": "https://usn.ubuntu.com/3727-1" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "type": "CVSS_V3" } ], "summary": "In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.