bcprov-jdk15on-1.54.jar: 19 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - bcprov-jdk15on-1.54.jar

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/web/nibrs-web/target/nibrs-web/WEB-INF/lib/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar,/home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (bcprov-jdk15on version)	Remediation Possible**
CVE-2024-29857	High	7.5	bcprov-jdk15on-1.54.jar	Direct	org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1	✅
CVE-2019-17359	High	7.5	bcprov-jdk15on-1.54.jar	Direct	1.64	✅
CVE-2018-1000180	High	7.5	bcprov-jdk15on-1.54.jar	Direct	1.57	✅
CVE-2016-1000343	High	7.5	bcprov-jdk15on-1.54.jar	Direct	1.56	✅
CVE-2016-1000342	High	7.5	bcprov-jdk15on-1.54.jar	Direct	1.56	✅
CVE-2016-1000340	High	7.5	bcprov-jdk15on-1.54.jar	Direct	1.56	✅
CVE-2016-1000338	High	7.5	bcprov-jdk15on-1.54.jar	Direct	1.56	✅
CVE-2016-1000352	High	7.4	bcprov-jdk15on-1.54.jar	Direct	1.56	✅
CVE-2016-1000344	High	7.4	bcprov-jdk15on-1.54.jar	Direct	1.56	✅
CVE-2024-30172	Medium	5.9	bcprov-jdk15on-1.54.jar	Direct	org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk14:1.78, BouncyCastle.Cryptography - 2.3.1	✅
CVE-2020-15522	Medium	5.9	bcprov-jdk15on-1.54.jar	Direct	1.66	✅
CVE-2016-1000341	Medium	5.9	bcprov-jdk15on-1.54.jar	Direct	1.56	✅
CVE-2023-33202	Medium	5.5	bcprov-jdk15on-1.54.jar	Direct	org.bouncycastle:bcprov-jdk14:1.73, org.bouncycastle:bcprov-jdk15to18: 1.73, org.bouncycastle:bcprov-jdk18on:1.73	✅
CVE-2023-33201	Medium	5.3	bcprov-jdk15on-1.54.jar	Direct	org.bouncycastle:bcprov-ext-jdk18on:1.74, org.bouncycastle:bcprov-jdk18on:1.74, org.bouncycastle:bcprov-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-jdk15to18:1.74, org.bouncycastle:bcprov-jdk15to18:1.74, org.bouncycastle:bcprov-debug-jdk14:1.74, org.bouncycastle:bcprov-debug-jdk15to18:1.74, org.bouncycastle:bcprov-ext-debug-jdk14:1.74, org.bouncycastle:bcprov-ext-debug-jdk15to18:1.74, org.bouncycastle:bcprov-jdk14:1.74	✅
CVE-2020-26939	Medium	5.3	bcprov-jdk15on-1.54.jar	Direct	1.61	✅
CVE-2016-1000339	Medium	5.3	bcprov-jdk15on-1.54.jar	Direct	1.56	✅
CVE-2016-1000346	Low	3.7	bcprov-jdk15on-1.54.jar	Direct	1.56	✅
CVE-2016-1000345	Low	3.7	bcprov-jdk15on-1.54.jar	Direct	1.56	✅
CVE-2015-6644	Low	3.3	bcprov-jdk15on-1.54.jar	Direct	1.55	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (16 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2024-29857

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Publish Date: 2024-05-14

URL: CVE-2024-29857

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-8xfc-gm6g-vgpv

Release Date: 2024-05-14

Fix Resolution: org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2019-17359

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

Publish Date: 2019-10-08

URL: CVE-2019-17359

### CVSS 3 Score Details (7.5)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17359

Release Date: 2019-10-08

Fix Resolution: 1.64

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2018-1000180

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

Publish Date: 2018-06-05

URL: CVE-2018-1000180

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000180

Release Date: 2018-06-05

Fix Resolution: 1.57

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000343

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.

Publish Date: 2018-06-04

URL: CVE-2016-1000343

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000343

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000342

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Publish Date: 2018-06-04

URL: CVE-2016-1000342

### CVSS 3 Score Details (7.5)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000342

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000340

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.

Publish Date: 2018-06-04

URL: CVE-2016-1000340

### CVSS 3 Score Details (7.5)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000340

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000338

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Publish Date: 2018-06-01

URL: CVE-2016-1000338

### CVSS 3 Score Details (7.5)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000338

Release Date: 2018-06-01

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000352

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Publish Date: 2018-06-04

URL: CVE-2016-1000352

### CVSS 3 Score Details (7.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000352

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000344

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Publish Date: 2018-06-04

URL: CVE-2016-1000344

### CVSS 3 Score Details (7.4)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000344

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2024-30172

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

Publish Date: 2024-05-09

URL: CVE-2024-30172

### CVSS 3 Score Details (5.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-m44j-cfrm-g8qc

Release Date: 2024-03-24

Fix Resolution: org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk14:1.78, BouncyCastle.Cryptography - 2.3.1

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2020-15522

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.

Publish Date: 2021-05-20

URL: CVE-2020-15522

### CVSS 3 Score Details (5.9)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15522

Release Date: 2021-05-20

Fix Resolution: 1.66

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000341

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

Publish Date: 2018-06-04

URL: CVE-2016-1000341

### CVSS 3 Score Details (5.9)

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000341

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2023-33202

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.)

Publish Date: 2023-11-23

URL: CVE-2023-33202

### CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-wjxj-5m7g-mg7q

Release Date: 2023-11-23

Fix Resolution: org.bouncycastle:bcprov-jdk14:1.73, org.bouncycastle:bcprov-jdk15to18: 1.73, org.bouncycastle:bcprov-jdk18on:1.73

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2023-33201

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Publish Date: 2023-07-05

URL: CVE-2023-33201

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2023-07-05

Fix Resolution: org.bouncycastle:bcprov-ext-jdk18on:1.74, org.bouncycastle:bcprov-jdk18on:1.74, org.bouncycastle:bcprov-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-jdk15to18:1.74, org.bouncycastle:bcprov-jdk15to18:1.74, org.bouncycastle:bcprov-debug-jdk14:1.74, org.bouncycastle:bcprov-debug-jdk15to18:1.74, org.bouncycastle:bcprov-ext-debug-jdk14:1.74, org.bouncycastle:bcprov-ext-debug-jdk15to18:1.74, org.bouncycastle:bcprov-jdk14:1.74

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2020-26939

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.

Publish Date: 2020-11-02

URL: CVE-2020-26939

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-11-02

Fix Resolution: 1.61

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

CVE-2016-1000339

### Vulnerable Library - bcprov-jdk15on-1.54.jar

Library home page: http://www.bouncycastle.org/java.html

Path to dependency file: /tools/nibrs-staging-data/pom.xml

Dependency Hierarchy: - :x: **bcprov-jdk15on-1.54.jar** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.

Publish Date: 2018-06-04

URL: CVE-2016-1000339

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000339

Release Date: 2018-06-04

Fix Resolution: 1.56

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

snowdensb / nibrs

bcprov-jdk15on-1.54.jar: 19 vulnerabilities (highest severity is: 7.5) - autoclosed #457

Vulnerabilities

Details