CVE-2016-1000345
Description
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
Risk Information
Base Score
5.9
MODERATE
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.802
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple vulnerabilities are fixed in BouncyCastle - bcprov-jdk14 1.56 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.4 | Windows |
| Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.0.2 | Windows |
| Multiple vulnerabilities are fixed in BouncyCastle-bcprov-jdk15on 1.56 | Windows |
| Multiple vulnerabilities are fixed in BouncyCastle - bcprov-jdk15 1.56 | Windows |
| Multiple vulnerabilities are fixed in BouncyCastle - bcprov-jdk14 for Linux 1.56 | Linux |
| Multiple vulnerabilities are fixed in BouncyCastle-bcprov-jdk15on for Linux 1.56 | Linux |
| Multiple vulnerabilities are fixed in BouncyCastle - bcprov-jdk15 for Linux 1.56 | Linux |
| CVE-2016-1000345 | NCM |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234