CVE-2016-1000341
| Severity | 5.9 Medium CVSS 3.0 2 scores |
|---|---|
| Fixed in | 1.56 |
| Weakness | CWE-361 |
| Published | 4 Jun 2018 |
| Updated | 17 Jun 2026 |
Description
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 8 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 2.5% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE has an ARMR patch rule that provides mitigation |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2016-1000341.armr patch rule, ARMR 2.6 added 2019-03-28 updated 2026-03-04How to mitigate CVE-2016-1000341
Upgrade the affected software to 1.56 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
5.9 MEDIUM
v3.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
CVSS
5.9 MEDIUM v3.0CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.0 | 5.9 | MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.bouncycastle:bcprov-jdk14 |
0 | 1.56 |
unbounded |
org.bouncycastle:bcprov-jdk15 |
0 | 1.56 |
unbounded |
org.bouncycastle:bcprov-jdk15on |
0 | 1.56 |
unbounded |
Products and versions
5 products, 5 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | bouncycastle | bc-java | generic | ≤ 1.55 |
| nvd | debian | debian linux | generic | 8.0 |
| osv | org.bouncycastle | bcprov-jdk14 | generic | ＜ 1.56 |
| osv | org.bouncycastle | bcprov-jdk15 | generic | ＜ 1.56 |
| osv | org.bouncycastle | bcprov-jdk15on | generic | ＜ 1.56 |
References
Timeline
Timeline
| Published | 2018-06-04 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2019-03-28 | Earliest commit adding this CVE's ARMR patch or security rule. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2026-03-04 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |