WaratekVRT Sign in

CVE-2016-1000342

Severity7.5 High CVSS 3.0 2 scores
Fixed in1.56
WeaknessCWE-347
Published4 Jun 2018
Updated17 Jun 2026

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 8 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 1.8% chance in 30 days

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2016-1000342.armr patch rule, ARMR 2.6 added 2019-08-20 updated 2026-03-04
Sign in to download

How to mitigate CVE-2016-1000342

Upgrade the affected software to 1.56 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.5 HIGH v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N NVD Primary published
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.bouncycastle:bcprov-jdk14 0 1.56 unbounded
org.bouncycastle:bcprov-jdk15 0 1.56 unbounded
org.bouncycastle:bcprov-jdk15on 0 1.56 unbounded

Products and versions

5 products, 5 version entries
SourceVendorProductSchemeAffected versions
nvd bouncycastle bc-java generic ≤ 1.55
nvd debian debian linux generic 8.0
osv org.bouncycastle bcprov-jdk14 generic ＜ 1.56
osv org.bouncycastle bcprov-jdk15 generic ＜ 1.56
osv org.bouncycastle bcprov-jdk15on generic ＜ 1.56

References

URLTags
https://github.com/bcgit/bc-java/commit/843c2e60f67d71faf81d236f448ebbe56c62c647#diff-25c3c78db788365f36839b3f2d3016b9 WEB
https://access.redhat.com/errata/RHSA-2018:2669 WEB
https://access.redhat.com/errata/RHSA-2018:2927 WEB
https://github.com/bcgit/bc-java PACKAGE
https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html WEB
https://security.netapp.com/advisory/ntap-20181127-0004 WEB
https://usn.ubuntu.com/3727-1 WEB
https://www.oracle.com/security-alerts/cpuoct2020.html WEB
https://security.netapp.com/advisory/ntap-20181127-0004/
https://usn.ubuntu.com/3727-1/

Timeline
Published2018-06-04By the CVE Program.
ARMR remediation created2019-08-20Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-17NVD's own last-modified date for this record.