The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade bouncycastle | Feb 20, 2019 | Jun 4, 2018 |
| Suse | — | Upgrade bouncycastle-pgUpgrade bouncycastle | Jun 16, 2018 | Jun 4, 2018 |
| Ubuntu | — | Upgrade libbcmail-javaUpgrade libbcpg-javaUpgrade libbcprov-javaUpgrade libbcpkix-java | Aug 8, 2018 | Jun 4, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub