WaratekVRT Sign in

CVE-2016-1000343

Severity7.5 High CVSS 3.0 2 scores
Fixed in1.56
WeaknessCWE-310
Published4 Jun 2018
Updated17 Jun 2026

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 8 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 3.2% chance in 30 days

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2016-1000343.armr patch rule, ARMR 2.6 added 2019-08-20 updated 2026-03-04
Sign in to download

How to mitigate CVE-2016-1000343

Upgrade the affected software to 1.56 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.5 HIGH v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N NVD Primary published
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:P/I:N/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.bouncycastle:bcprov-jdk14 0 1.56 unbounded
org.bouncycastle:bcprov-jdk15 0 1.56 unbounded
org.bouncycastle:bcprov-jdk15on 0 1.56 unbounded

Products and versions

5 products, 5 version entries
SourceVendorProductSchemeAffected versions
nvd bouncycastle bc-java generic ≤ 1.55
nvd debian debian linux generic 8.0
osv org.bouncycastle bcprov-jdk14 generic ＜ 1.56
osv org.bouncycastle bcprov-jdk15 generic ＜ 1.56
osv org.bouncycastle bcprov-jdk15on generic ＜ 1.56

References

URLTags
https://github.com/bcgit/bc-java/commit/50a53068c094d6cff37659da33c9b4505becd389#diff-5578e61500abb2b87b300d3114bdfd7d WEB
https://access.redhat.com/errata/RHSA-2018:2669 WEB
https://access.redhat.com/errata/RHSA-2018:2927 WEB
https://github.com/advisories/GHSA-rrvx-pwf8-p59p ADVISORY
https://github.com/bcgit/bc-java PACKAGE
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E WEB
https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html WEB
https://security.netapp.com/advisory/ntap-20181127-0004 WEB
https://usn.ubuntu.com/3727-1 WEB
https://www.oracle.com/security-alerts/cpuoct2020.html WEB

Timeline
Published2018-06-04By the CVE Program.
ARMR remediation created2019-08-20Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-17NVD's own last-modified date for this record.