Filtered by vendor Bouncycastle Subscriptions
Filtered by product Bc-java Subscriptions

Search

Switch to Advanced Search (Beta)
Total 25 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-1000341 3 Bouncycastle, Debian, Redhat 5 Bc-java, Debian Linux, Jboss Fuse and 2 more 2025-05-12 N/A
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
CVE-2016-1000342 3 Bouncycastle, Debian, Redhat 5 Bc-java, Debian Linux, Jboss Fuse and 2 more 2025-05-12 N/A
In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
CVE-2018-5382 2 Bouncycastle, Redhat 3 Bc-java, Satellite, Satellite Capsule 2025-05-12 4.4 Medium
The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.
CVE-2020-28052 4 Apache, Bouncycastle, Oracle and 1 more 27 Karaf, Bc-java, Banking Corporate Lending Process Management and 24 more 2025-05-12 8.1 High
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
CVE-2023-33201 2 Bouncycastle, Redhat 10 Bc-java, Amq Broker, Amq Streams and 7 more 2024-12-04 5.3 Medium
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.