CVE-2016-1000338
Description
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of invisible data into a signed structure.
Risk Information
Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.371
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple vulnerabilities are fixed in BouncyCastle - bcprov-jdk14 1.56 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.4 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.0.2 | Windows |
| Vulnerabilities CVE-2016-1000338 are fixed in BouncyCastle-bcprov-jdk15on 1.56 | Windows |
| Vulnerabilities CVE-2016-1000338 are fixed in BouncyCastle - bcprov-jdk15 1.56 | Windows |
| Java implementation of cryptographic algorithms (USN-3727-1) libbcpg-java_1.49+dfsg-2ubuntu0.1_all.deb | Linux |
| Java implementation of cryptographic algorithms (USN-3727-1) libbcmail-java_1.49+dfsg-2ubuntu0.1_all.deb | Linux |
| Java implementation of cryptographic algorithms (USN-3727-1) libbcpkix-java_1.49+dfsg-2ubuntu0.1_all.deb | Linux |
| Java implementation of cryptographic algorithms (USN-3727-1) libbcprov-java_1.49+dfsg-2ubuntu0.1_all.deb | Linux |
| Multiple vulnerabilities are fixed in BouncyCastle - bcprov-jdk14 for Linux 1.56 | Linux |
| Vulnerabilities CVE-2016-1000338 are fixed in BouncyCastle-bcprov-jdk15on for Linux 1.56 | Linux |
| Vulnerabilities CVE-2016-1000338 are fixed in BouncyCastle - bcprov-jdk15 for Linux 1.56 | Linux |
| Improper Verification of Cryptographic Signature Vulnerability (CVE-2016-1000338) | NCM |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234