WaratekVRT Sign in

CVE-2016-1000344

Severity7.4 High CVSS 3.0 2 scores
Fixed in1.56
WeaknessCWE-310
Published4 Jun 2018
Updated17 Jun 2026

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

CWE-1310

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 8 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 2.1% chance in 30 days

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2016-1000344.armr patch rule, ARMR 2.6 added 2019-08-20 updated 2026-03-04
Sign in to download

How to mitigate CVE-2016-1000344

Upgrade the affected software to 1.56 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.4 HIGH v3.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 7.4 HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N NVD Primary published
CVSS 2.0 5.8 none AV:N/AC:M/Au:N/C:P/I:P/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.bouncycastle:bcprov-jdk14 0 1.56 unbounded
org.bouncycastle:bcprov-jdk15 0 1.56 unbounded
org.bouncycastle:bcprov-jdk15on 0 1.56 unbounded

Products and versions

4 products, 4 version entries
SourceVendorProductSchemeAffected versions
nvd bouncycastle bc-java generic ≤ 1.55
osv org.bouncycastle bcprov-jdk14 generic ＜ 1.56
osv org.bouncycastle bcprov-jdk15 generic ＜ 1.56
osv org.bouncycastle bcprov-jdk15on generic ＜ 1.56

References

URLTags
https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f WEB
https://access.redhat.com/errata/RHSA-2018:2669 WEB
https://access.redhat.com/errata/RHSA-2018:2927 WEB
https://github.com/advisories/GHSA-2j2x-hx4g-2gf4 ADVISORY
https://security.netapp.com/advisory/ntap-20181127-0004 WEB
https://www.oracle.com/security-alerts/cpuoct2020.html WEB
https://security.netapp.com/advisory/ntap-20181127-0004/

Timeline
Published2018-06-04By the CVE Program.
ARMR remediation created2019-08-20Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-17NVD's own last-modified date for this record.