vulnerability
Ubuntu: USN-3727-1 (CVE-2016-1000338): Bouncy Castle vulnerabilities
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:N/I:P/A:N) | Jun 1, 2018 | Aug 8, 2018 | Mar 27, 2026 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
Jun 1, 2018
Added
Aug 8, 2018
Modified
Mar 27, 2026
Description
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Solutions
ubuntu-upgrade-libbcmail-javaubuntu-upgrade-libbcpg-javaubuntu-upgrade-libbcpkix-javaubuntu-upgrade-libbcprov-java
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.