bcprov-jdk15on-1.55.jar: 14 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - bcprov-jdk15on-1.55.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Path to vulnerable library: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml,/nifi-commons/nifi-security-utils/pom.xml,/nifi-nar-bundles/nifi-provenance-repository-bundle/nifi-persistent-provenance-repository/pom.xml,/nifi-nar-bundles/nifi-provenance-repository-bundle/nifi-provenance-repository-nar/pom.xml,/nifi-commons/nifi-web-utils/pom.xml,/nifi-commons/nifi-data-provenance-utils/pom.xml,/nifi-commons/nifi-site-to-site-client/pom.xml,/nifi-nar-bundles/nifi-provenance-repository-bundle/nifi-volatile-provenance-repository/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/pom.xml,/nifi-mock/pom.xml,/nifi-bootstrap/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-security/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-core-api/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-cluster-protocol/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-properties-loader/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework-nar/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-site-to-site/pom.xml,/nifi-commons/nifi-socket-utils/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-ssl-context-bundle/nifi-ssl-context-service/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-security/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-lookup-services-bundle/nifi-lookup-services/pom.xml,/nifi-nar-bundles/nifi-extension-utils/nifi-processor-utils/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/pom.xml,/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-optimistic-locking/pom.xml,/nifi-nar-bundles/nifi-standard-services/nifi-distributed-cache-services-bundle/nifi-distributed-cache-client-service/pom.xml

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (bcprov-jdk15on version)	Remediation Possible**
CVE-2018-1000613	Critical	9.8	bcprov-jdk15on-1.55.jar	Direct	1.57	✅
CVE-2019-17359	High	7.5	bcprov-jdk15on-1.55.jar	Direct	1.62.0.redhat-00001	✅
CVE-2016-1000338	High	7.5	bcprov-jdk15on-1.55.jar	Direct	1.56	✅
CVE-2018-1000180	High	7.5	bcprov-jdk15on-1.55.jar	Direct	1.57	✅
CVE-2016-1000340	High	7.5	bcprov-jdk15on-1.55.jar	Direct	1.56	✅
CVE-2016-1000342	High	7.5	bcprov-jdk15on-1.55.jar	Direct	1.56	✅
CVE-2016-1000352	High	7.4	bcprov-jdk15on-1.55.jar	Direct	1.56	✅
CVE-2016-1000345	Medium	5.9	bcprov-jdk15on-1.55.jar	Direct	1.56	✅
CVE-2016-1000341	Medium	5.9	bcprov-jdk15on-1.55.jar	Direct	1.56	✅
CVE-2016-1000339	Medium	5.3	bcprov-jdk15on-1.55.jar	Direct	1.56	✅
CVE-2016-1000343	Medium	5.3	bcprov-jdk15on-1.55.jar	Direct	1.56	✅
CVE-2020-26939	Medium	5.3	bcprov-jdk15on-1.55.jar	Direct	1.61	✅
CVE-2016-1000344	Medium	4.8	bcprov-jdk15on-1.55.jar	Direct	1.56	✅
CVE-2016-1000346	Low	3.7	bcprov-jdk15on-1.55.jar	Direct	1.56	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (13 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2018-1000613

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.

Publish Date: 2018-07-09

URL: CVE-2018-1000613

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000613

Release Date: 2018-07-09

Fix Resolution: 1.57

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2019-17359

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

Publish Date: 2019-10-08

URL: CVE-2019-17359

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17359

Release Date: 2019-10-08

Fix Resolution: 1.62.0.redhat-00001

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000338

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Publish Date: 2018-06-01

URL: CVE-2016-1000338

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000338

Release Date: 2018-06-01

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2018-1000180

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

Publish Date: 2018-06-05

URL: CVE-2018-1000180

### CVSS 3 Score Details (7.5)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000180

Release Date: 2018-06-05

Fix Resolution: 1.57

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000340

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.

Publish Date: 2018-06-04

URL: CVE-2016-1000340

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000340

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000342

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Publish Date: 2018-06-04

URL: CVE-2016-1000342

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000342

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000352

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Publish Date: 2018-06-04

URL: CVE-2016-1000352

### CVSS 3 Score Details (7.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000352

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000345

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.

Publish Date: 2018-06-04

URL: CVE-2016-1000345

### CVSS 3 Score Details (5.9)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000345

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000341

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

Publish Date: 2018-06-04

URL: CVE-2016-1000341

### CVSS 3 Score Details (5.9)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000341

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000339

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.

Publish Date: 2018-06-04

URL: CVE-2016-1000339

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000339

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000343

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.

Publish Date: 2018-06-04

URL: CVE-2016-1000343

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000343

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2020-26939

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.

Publish Date: 2020-11-02

URL: CVE-2020-26939

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-11-02

Fix Resolution: 1.61

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000344

### Vulnerable Library - bcprov-jdk15on-1.55.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-administration/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.55.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Publish Date: 2018-06-04

URL: CVE-2016-1000344

### CVSS 3 Score Details (4.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000344

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

CarOrgSima / nifi-1.4.0

bcprov-jdk15on-1.55.jar: 14 vulnerabilities (highest severity is: 9.8) - autoclosed #74

Vulnerabilities

Details