CVE-2016-1000352: bouncycastle bc-java Cryptographic Issues
CVSS: 7.4v3.0HighModified
AliasesUBUNTU-CVE-2016-1000352DEBIAN-CVE-2016-1000352CGA-2874-p3vg-gmf9CGA-2m94-ccvp-h427CGA-2wxm-fm53-h467CGA-2xr4-727c-rxcpCGA-3525-hcv2-9vqjCGA-36qj-h98m-x487CGA-3j8f-p85j-wq9vCGA-3pvw-7f3q-fcmrCGA-473h-c497-8qg4CGA-4g7p-3c6r-94h3CGA-4qx3-g47m-v379CGA-4vv8-cf87-3582CGA-4w3m-gfxp-69cgCGA-4x86-3hqr-cm25CGA-5j7x-rq7m-8wmxCGA-67vh-w7vg-w242CGA-67w4-p7wq-w4j3CGA-6jx6-6c87-vg4wCGA-73jm-3fqj-8q63CGA-8g3f-682h-f5cqCGA-8r2p-372g-42mfCGA-8x6g-c4fm-77vcCGA-9f47-696g-vgxxCGA-9x83-q38m-464jCGA-c95c-8x25-82mqCGA-ccqg-v5hw-c6p3CGA-cg62-cfcr-c52cCGA-f353-pm97-vh62CGA-f5hm-j4m8-4h2wCGA-g4cg-qxv2-76c2CGA-g58x-r7g2-p3qvCGA-h345-fp4h-fvh7CGA-h3w2-r38x-g79vCGA-h5f3-9x5r-jh87CGA-h779-fxfw-w3q3CGA-h9hw-43vr-7mhgCGA-hghp-4php-m862CGA-hwxm-pmc4-3h95CGA-j4v4-qm6m-phc8CGA-jm3r-q3r4-rfxvCGA-mr8q-j36g-99jrCGA-p2hv-2p6c-4fc7CGA-p555-r2m7-5c69CGA-p8h3-3m33-274hCGA-p8wg-jhwv-jmrxCGA-phff-v6jq-5393GHSA-w285-wf9q-5w69CGA-q55j-2m3f-4m88CGA-q7qw-6372-w9m5CGA-q9q2-679r-r83vCGA-qhwv-f3m2-cc3rCGA-qqj8-cg47-cpqxCGA-qqvf-hr7f-4rj4CGA-qr65-gxg4-283wCGA-qw63-8343-6r6vCGA-r2pp-7qff-rpjmCGA-r3gp-hxfr-gj7wCGA-r48j-8344-f375CGA-rfrj-wgmr-vw27CGA-rhjm-9r56-m6fmCGA-rjjw-9hm7-7w4jCGA-rmwj-3fxx-4rmrCGA-rr28-v9mm-2cqxCGA-rvjm-8236-wx98CGA-v2pp-hjxf-f5xqCGA-v2pv-594c-8j3cCGA-w4gc-mhwg-g38pCGA-wcc5-22vh-c5j9CGA-wv66-58vv-3hcqCGA-wwm9-p6x6-x5jpCGA-x2r4-864x-x726CGA-xm8j-84vh-4qfwCGA-xmhj-mrj5-6v69CGA-xpxw-q3xg-mfqrCGA-xrqg-98fm-wg48
Published 04-06-2018Last modified 06-08-2024
Vulnerability summary
CVE-2016-1000352 is a high (CVSS 7.4) Cryptographic Issues vulnerability in bouncycastle bc-java. EPSS estimates a 2.17% chance of exploitation in the next 30 days, higher than 81.9% of scored vulnerabilities.
CVSS score
7.4/10
010
High · v3.0 (NVD)EPSS score
2.17%
0%100%
Low · -0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 04-06-2018PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.4Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.17%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
-0.04 pp
From 2.21% on 18-09-2026
18-09-202618-10-2026
EPSS score2.17%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard34 products
- eco-java-gradle-1.11All versions (No fix recorded)
- eco-java-gradle-2.0All versions (No fix recorded)
- eco-java-gradle-2.1All versions (No fix recorded)
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
Org.bouncycastle3 products
- bcprov-jdk14< 1.56
- bcprov-jdk15< 1.56
- bcprov-jdk15on< 1.56
Bouncycastle1 product
- bc-java≤ 1.55
Debian1 product
- bouncycastle< 1.56-1
Ubuntu1 product
- bouncycastleAll versions (No fix recorded)
5 vendors · 40 products
References
12 links- github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1fX Refsource CONFIRMPatchThird Party AdvisoryFIXWEB
Show all 12 references
- github.com/bcgit/bc-javaPACKAGE