QwikSec

Security Database

CVE

CWE

Training

CVE-2016-1000338

Published: Jun 1, 2018

Modified: Aug 6, 2024

PUBLISHED

Description

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

[debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update

mailing-list

vendor-advisory

vendor-advisory

vendor-advisory

[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report

mailing-list

https://www.oracle.com/security-alerts/cpuoct2020.html

https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0

https://security.netapp.com/advisory/ntap-20231006-0011/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.