CVE-2016-1000345 Information

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older in an environment where timings can be easily observed it is possible with enough observations to identify when the decryption is failing due to padding.

CVSS Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Reference

https://access.redhat.com/errata/RHSA-2018:2669 https://access.redhat.com/errata/RHSA-2018:2927 https://github.com/bcgit/bc-java/commit/21dcb3d9744c83dcf2ff8fcee06dbca7bfa4ef35diff-4439ce586bf9a13bfec05c0d113b8098 https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html https://security.netapp.com/advisory/ntap-20181127-0004/ https://usn.ubuntu.com/3727-1/ https://www.oracle.com/security-alerts/cpuoct2020.html

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

5.9