CoreCVE
Back

MEDIUM

bouncycastle: Information exposure in DSA signature generation via timing attack

Published Jun 4, 2018

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

Affected products

Remediation

Red Hat statement

This issue affects the versions of bouncycastle as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having a security impact of Moderate. No update is planned for this product at this time. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Metrics

Weaknesses (2)

CWE-361

CWE-385

References (12)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 4, 2018
Updated Aug 6, 2024
Reserved Jun 4, 2018
Link CVE-2016-1000341
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2016-1000341
Red Hat
Severity Moderate
Public date Jun 7, 2018
Links CVE-2016-1000341 - Bugzilla
GHSA-R9CH-M4FH-FC7Q