Inadequate DH Public Key Validation in Bouncy Castle JCE Provider - CVE-2016-1000346
Summary
CVE-2016-1000346: In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. Affects bouncycastle across 2 version ranges.
< 1.56-1
< 1127131c89021612c6eefa26dbe5714c194e7495
Fixed in 1.56-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bouncy Castle is a widely used cryptographic library that provides a lightweight API for various cryptographic operations. It supports a range of encryption algorithms and protocols, making it a popular choice for developers needing secure communication. However, the library has a vulnerability in its Diffie-Hellman (DH) key exchange implementation, specifically in versions 1.55 and earlier, where the public key from the other party is not fully validated, potentially compromising the security of the key exchange process.
Vulnerability Detail
The vulnerability arises from the insufficient validation of the other party's DH public key during the key agreement calculation. This flaw can allow an attacker to exploit invalid keys, which may lead to the exposure of sensitive information about the other party's private key when static Diffie-Hellman is utilized. The issue was identified in the Bouncy Castle JCE Provider up to version 1.55, and it was addressed in version 1.56, where proper checks on key parameters were implemented to enhance security.
How To Fix
Minimum fixed version
1.56-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bouncycastleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing additional validation checks for DH public keys in your application code. This can involve verifying the key's format and ensuring it adheres to expected parameters before proceeding with the key exchange process.
Conclusion
The vulnerability CVE-2016-1000346 in the Bouncy Castle JCE Provider poses a significant risk due to inadequate validation of DH public keys. Users are strongly advised to upgrade to version 1.56 or later to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until an upgrade is possible.
See every vulnerability recorded for bouncycastle →
FAQ
CVE-2016-1000346 is a vulnerability in the Bouncy Castle JCE Provider that involves inadequate validation of Diffie-Hellman public keys, potentially leading to security risks.
Versions 1.55 and earlier of the Bouncy Castle JCE Provider are affected by this vulnerability.
Exploitation of this vulnerability could allow attackers to gain insights into the private keys of the other party during a static Diffie-Hellman key exchange.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2016-1000346 is 3.7, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for bouncycastle.
