The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade bouncycastle | Feb 20, 2019 | Jun 4, 2018 |
| Suse | — | Upgrade bouncycastle-pgUpgrade bouncycastle | Jun 16, 2018 | Jun 4, 2018 |
| Ubuntu | — | Upgrade libbcpg-javaUpgrade libbcmail-javaUpgrade libbcpkix-javaUpgrade libbcprov-java | Aug 8, 2018 | Jun 4, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub