PT-2018-4641

CVE-2016-1000352

Published

2018-06-04

Updated

2024-06-15

Description by

CVSS 3.1

7.4

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle JCE Provider versions 1.55 and earlier

Description The issue concerns the use of ECB mode in the ECIES implementation, which is considered unsafe. Support for this mode has been removed due to its unsafe nature.

Recommendations For Bouncy Castle JCE Provider versions 1.55 and earlier, consider updating to a version where ECB mode support has been removed to mitigate the risk.

Exploitability

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-310

CWE-326: Inadequate Encryption Strength

Related identifiers

CVE-2016-1000352

GHSA-W285-WF9Q-5W69

MGASA-2018-0376