CVE-2016-1000346: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

October 17, 2018 (updated September 10, 2021)

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party’s private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

References

github.com/advisories/GHSA-fjqm-246c-mwqg
github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495
nvd.nist.gov/vuln/detail/CVE-2016-1000346

Detect and mitigate CVE-2016-1000346 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →