CVE-2016-1000340
Description
In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
Risk Information
Base Score
7.5
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.397
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple vulnerabilities are fixed in BouncyCastle - bcprov-jdk14 1.56 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.4 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.0.2 | Windows |
| Vulnerabilities CVE-2016-1000340 are fixed in BouncyCastle-bcprov-jdk15on 1.56 | Windows |
| Vulnerabilities CVE-2016-1000340 are fixed in BouncyCastle - bcprov-jdk15 1.56 | Windows |
| Multiple vulnerabilities are fixed in BouncyCastle - bcprov-jdk14 for Linux 1.56 | Linux |
| Vulnerabilities CVE-2016-1000340 are fixed in BouncyCastle-bcprov-jdk15on for Linux 1.56 | Linux |
| Vulnerabilities CVE-2016-1000340 are fixed in BouncyCastle - bcprov-jdk15 for Linux 1.56 | Linux |
| CVE-2016-1000340 | NCM |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234