WaratekVRT Sign in

CVE-2016-1000345

Severity5.9 Medium CVSS 3.0 2 scores
Fixed in1.56
WeaknessCWE-361
Published4 Jun 2018
Updated17 Jun 2026

Description

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 8 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 2.6% chance in 30 days

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2016-1000345.armr patch rule, ARMR 2.6 added 2019-03-29 updated 2026-03-04
Sign in to download

How to mitigate CVE-2016-1000345

Upgrade the affected software to 1.56 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

5.9 MEDIUM v3.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 5.9 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N NVD Primary published
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:P/I:N/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.bouncycastle:bcprov-jdk14 0 1.56 unbounded
org.bouncycastle:bcprov-jdk15 0 1.56 unbounded
org.bouncycastle:bcprov-jdk15on 0 1.56 unbounded

Products and versions

5 products, 5 version entries
SourceVendorProductSchemeAffected versions
nvd bouncycastle bc-java generic ≤ 1.55
nvd debian debian linux generic 8.0
osv org.bouncycastle bcprov-jdk14 generic ＜ 1.56
osv org.bouncycastle bcprov-jdk15 generic ＜ 1.56
osv org.bouncycastle bcprov-jdk15on generic ＜ 1.56

References

URLTags
https://github.com/bcgit/bc-java/commit/21dcb3d9744c83dcf2ff8fcee06dbca7bfa4ef35#diff-4439ce586bf9a13bfec05c0d113b8098 WEB
https://access.redhat.com/errata/RHSA-2018:2669 WEB
https://access.redhat.com/errata/RHSA-2018:2927 WEB
https://github.com/advisories/GHSA-9gp4-qrff-c648 ADVISORY
https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html WEB
https://security.netapp.com/advisory/ntap-20181127-0004 WEB
https://usn.ubuntu.com/3727-1 WEB
https://www.oracle.com/security-alerts/cpuoct2020.html WEB
https://security.netapp.com/advisory/ntap-20181127-0004/
https://usn.ubuntu.com/3727-1/

Timeline
Published2018-06-04By the CVE Program.
ARMR remediation created2019-03-29Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-17NVD's own last-modified date for this record.