veritem/springboot-template

CVE-2016-1000343 (High) detected in bcprov-jdk15on-1.50.jar

Closed this issue · 0 comments

mend-bolt-for-github commented

CVE-2016-1000343 - High Severity Vulnerability

Vulnerable Library - bcprov-jdk15on-1.50.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.7.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: springboot-template/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.50/bcprov-jdk15on-1.50.jar

Dependency Hierarchy:

  • passay-1.0.jar (Root Library)
    • cryptacular-1.0.jar
      • ❌ bcprov-jdk15on-1.50.jar (Vulnerable Library)

Found in HEAD commit: 01ac1a359f8ea94a04ca4a65820afb352f5bbc25

Found in base branch: main

Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.

Publish Date: 2018-06-04

URL: CVE-2016-1000343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000343

Release Date: 2018-06-04

Fix Resolution: org.bouncycastle:bcprov-debug-jdk14:1.56,org.bouncycastle:bcprov-ext-jdk15on:1.56,org.bouncycastle:bcprov-jdk14:1.56,org.bouncycastle:bcprov-jdk15on:1.56,org.bouncycastle:bcprov-ext-debug-jdk15on:1.56

Step up your Open Source Security Game with WhiteSource here