ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2016-1000338

—
CVSS 3.1
7.5 high
EPSS
2%p78
Published
()
Modified
Description

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Vendors
bouncycastleredhatcanonicalnetapp
Products
legion-of-the-bouncy-castle-java-crytography-api, satellite, satellite capsule, ubuntu linux, 7-mode transition tool
Weakness
CWE-347
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD CVE.org GitHub PoCs EPSS (1.9%)

In the news

No ingested article mentions this CVE yet.