CVE-2016-1000338

Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions 1.55 and earlier

Description The issue concerns the DSA in the Bouncy Castle JCE Provider, which does not fully validate ASN.1 encoding of a signature during verification. This allows for the injection of extra elements into the sequence that makes up the signature, enabling it to still validate. In some cases, this could allow the introduction of 'invisible' data into a signed structure.

Recommendations For Bouncy Castle JCE Provider versions 1.55 and earlier, update to a version later than 1.55 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability in Jira Work Management and Jira Software.