CVE-2016-1000346: bouncycastle bc-java Key Management Errors
CVSS: 4.3v2.0MediumModified
AliasesUBUNTU-CVE-2016-1000346DEBIAN-CVE-2016-1000346CGA-24m6-r938-jff7CGA-2cvw-5w9g-7652CGA-2fvq-f5x3-qvq2CGA-2r8h-cpc6-ww9fCGA-2xx8-23pc-2994CGA-3xxj-grv6-h9pcCGA-42xq-9xr5-jmv9CGA-4f5h-937v-j6hfCGA-55f2-vvw8-53ppCGA-56g2-rg7q-rc6hCGA-62pj-mrhx-jrqhCGA-62xv-vhwv-499cCGA-69j4-gwm2-2cw5CGA-6fvw-rrp4-33mwCGA-6pg5-vp52-p2r7CGA-6pj3-9f35-8cf4CGA-6qmr-px63-fp79CGA-73g6-83jw-7q2pCGA-75mw-v66g-6x8fCGA-78pw-3q7v-8998CGA-7xhh-m7fq-43mjCGA-837r-9r25-6wp9CGA-89pw-q364-v9mcCGA-89x3-wvf4-m7qcCGA-8g63-gp7q-2h5jCGA-93m4-qh4w-8jg9CGA-93pr-jq37-j6c5CGA-98r4-f4h4-798qCGA-9jhg-6hg7-c9p9CGA-c4pr-c397-rcrqCGA-c8h5-7vj3-4vj3CGA-cccp-8rg8-xrjhCGA-cf8f-8fx9-prpcCGA-ch5c-9gfp-cjv4CGA-cm86-h4jf-xhg6CGA-cpw2-6c94-cp3pCGA-fjjx-xhj8-h5jfCGA-fpr3-3pwr-4xmhCGA-fvw5-mg22-756wCGA-fw6q-mmpc-rm8fCGA-g2m4-6gx9-ggcpCGA-gwc6-jf8j-wpxxCGA-h83j-xvgp-q3v2CGA-h934-fhmr-wgcqCGA-hrp7-6x5v-5pcvCGA-hwr6-7q79-56q3CGA-jcc4-25f5-mvgrCGA-jqg2-xjmr-4jc2CGA-jx97-q572-545hCGA-m487-63h5-pjrvCGA-mgf8-4cc4-j4gqCGA-mhx9-m229-7g57CGA-mpgm-g8qg-j6c3CGA-p9v2-cfxw-vrfqCGA-pjj3-2m6r-pjm4CGA-ppfv-2vg4-6pv2GHSA-fjqm-246c-mwqgCGA-q2x8-3pq6-mwx4CGA-q7fr-qf9v-xcw7CGA-qg42-9679-rfjhCGA-r78h-2ccw-5fq5CGA-rf7p-97f8-vf7fCGA-v5fc-9m6g-qgrrCGA-v6cc-7m3r-9hc4CGA-w24q-f6rg-vc8hCGA-w4c4-pcjc-qv64CGA-w973-p5c8-cc7rCGA-wgqg-46fc-pw4wCGA-whqp-gc7c-fqc2CGA-wqp4-wh93-c42fCGA-wxf9-wq99-9cprCGA-x49p-6xc5-69wrCGA-x4gq-m6h3-vw24CGA-xf3c-xgjw-8gp9CGA-xpvm-jqxf-2w25
Published 04-06-2018Last modified 06-08-2024
Vulnerability summary
CVE-2016-1000346 is a medium (CVSS 4.3) Key Management Errors vulnerability in bouncycastle bc-java. EPSS estimates a 2.17% chance of exploitation in the next 30 days, higher than 82% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v2.0 (NVD)EPSS score
2.17%
0%100%
Low · -0.13 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 2Timeline
- 04-06-2018PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
CVSS metrics
6 scores · 5 sources · 2 versionsLow 3.7Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated3.7LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.7LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated3.7LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · MavenEcosystem advisory · calculated3.7LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
2.17%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
-0.13 pp
From 2.30% on 19-09-2026
19-09-202619-10-2026
EPSS score2.17%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard34 products
- eco-java-gradle-1.11All versions (No fix recorded)
- eco-java-gradle-2.0All versions (No fix recorded)
- eco-java-gradle-2.1All versions (No fix recorded)
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
Org.bouncycastle3 products
- bcprov-jdk14< 1.56
- bcprov-jdk15< 1.56
- bcprov-jdk15on< 1.56
Debian2 products
- bouncycastle< 1.56-1
- debian_linuxEOL8.0
Bouncycastle1 product
- bc-java≤ 1.55
Ubuntu1 product
- bouncycastle< 1.49+dfsg-2ubuntu0.1 | All versions (No fix recorded)
5 vendors · 41 products
References
16 links
lists.debian.org/debian-lts-announce/2018/07/msg00009.htmlMailing ListX Refsource MLISTThird Party AdvisoryAdvisoryWEB- github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495X Refsource CONFIRMPatchThird Party AdvisoryFIXWEB
Show all 16 references
- github.com/bcgit/bc-javaPACKAGE