Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFjajctZzJqNS1nN3Iz

In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Permalink: https://github.com/advisories/GHSA-qcj7-g2j5-g7r3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFjajctZzJqNS1nN3Iz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 6 years ago
Updated: almost 2 years ago

CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Percentage: 0.00376
EPSS Percentile: 0.725

Identifiers: GHSA-qcj7-g2j5-g7r3, CVE-2016-1000342
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-1000342
• https://github.com/bcgit/bc-java/commit/843c2e60f67d71faf81d236f448ebbe56c62c647#diff-25c3c78db788365f36839b3f2d3016b9
• https://access.redhat.com/errata/RHSA-2018:2669
• https://access.redhat.com/errata/RHSA-2018:2927
• https://github.com/advisories/GHSA-qcj7-g2j5-g7r3
• https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
• https://security.netapp.com/advisory/ntap-20181127-0004/
• https://usn.ubuntu.com/3727-1/
• https://www.oracle.com/security-alerts/cpuoct2020.html

Repository: https://github.com/bcgit/bc-java
Blast Radius: 22.5

Affected Packages