Fluid Attacks Database

Description

In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	bouncycastle	>=0 <1.56-1	1.56-1
debian 14	bouncycastle	>=0 <1.56-1	1.56-1
maven	org.bouncycastle:bcprov-jdk14	>=0 <1.56	1.56
maven	org.bouncycastle:bcprov-jdk15on	>=0 <1.56	1.56
debian 12	bouncycastle	>=0 <1.56-1	1.56-1
maven	org.bouncycastle:bcprov-jdk15	>=0 <1.56	1.56

Aliases

1. CVE-2016-10003522. NVD-2016-10003523. OSV-DEBIAN-2016-10003524. OSV-2016-10003525. GHSA-w285-wf9q-5w696. GCVE-2016-10003527. SECURITY-TRACKER-CVE-2016-10003528. access.redhat.com9. access.redhat.com

References

1. https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f2. https://security.netapp.com/advisory/ntap-20181127-00043. https://www.oracle.com/security-alerts/cpuoct2020.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.