VulnerableCode Package Details - pkg:maven/org.bouncycastle/bcprov-jdk15on@1.47

Vulnerabilities affecting this package (29)

Advisory	Summary	Fixed in package version
CVE-2016-1000342	In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on …	1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable 1.59 Vulnerable 1.60 Vulnerable 1.64 Vulnerable
CVE-2016-1000345	In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For …	1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable 1.59 Vulnerable 1.60 Vulnerable 1.64 Vulnerable 1.61 Vulnerable 1.62 Vulnerable 1.63 Vulnerable 1.65 Vulnerable 1.65.01 Vulnerable 1.66 Vulnerable
CVE-2016-1000340	In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of …	1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable 1.59 Vulnerable 1.60 Vulnerable 1.64 Vulnerable 1.61 Vulnerable 1.62 Vulnerable 1.63 Vulnerable 1.65 Vulnerable 1.65.01 Vulnerable 1.66 Vulnerable
CVE-2016-1000346	In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. …	1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable 1.59 Vulnerable 1.60 Vulnerable 1.64 Vulnerable 1.61 Vulnerable 1.62 Vulnerable 1.63 Vulnerable 1.65 Vulnerable 1.65.01 Vulnerable 1.66 Vulnerable
CVE-2016-1000343	In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key …	1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable 1.59 Vulnerable
CVE-2019-17359	The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant …	1.64 Vulnerable
CVE-2016-1000341	In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings …	1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable 1.59 Vulnerable 1.60 Vulnerable 1.64 Vulnerable 1.61 Vulnerable 1.62 Vulnerable 1.63 Vulnerable 1.65 Vulnerable 1.65.01 Vulnerable 1.66 Vulnerable
CVE-2016-1000338	In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on …	1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable 1.59 Vulnerable 1.60 Vulnerable
CVE-2015-6644	Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted …	1.55 Vulnerable 1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable
CVE-2016-1000339	In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due …	1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable 1.59 Vulnerable 1.60 Vulnerable 1.64 Vulnerable 1.61 Vulnerable 1.62 Vulnerable 1.63 Vulnerable 1.65 Vulnerable 1.65.01 Vulnerable 1.66 Vulnerable
CVE-2016-1000344	In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This …	1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable 1.59 Vulnerable 1.60 Vulnerable 1.64 Vulnerable 1.61 Vulnerable 1.62 Vulnerable 1.65 Vulnerable
CVE-2016-1000352	In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This …	1.56 Vulnerable 1.57 Vulnerable 1.58 Vulnerable 1.59 Vulnerable 1.60 Vulnerable 1.64 Vulnerable 1.61 Vulnerable 1.62 Vulnerable 1.65 Vulnerable
GHSA-4mv7-cq75-3qjm Aliases: CVE-2015-7940	Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 The Bouncy Castle Java library before 1.51 does not validate a point …	1.51 Vulnerable
GHSA-4vhj-98r6-424h Aliases: CVE-2016-1000338	In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and …	1.56 Vulnerable
GHSA-72m5-fvvv-55m6 Aliases: CVE-2020-26939	Observable Differences in Behavior to Error Inputs in Bouncy Castle In Legion of the Bouncy Castle BC before 1.55 and …	1.61 Vulnerable
GHSA-6xx3-rg99-gc3p Aliases: CVE-2020-15522	Timing based private key exposure in Bouncy Castle Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA …	1.66 Vulnerable
GHSA-8477-3v39-ggpm Aliases: CVE-2018-5382	Improper Validation of Integrity Check Value in Bouncy Castle The default BKS keystore use an HMAC that is only 16 …	1.50 Vulnerable
GHSA-8353-fgcr-xfhx Aliases: CVE-2013-1624	Improper Input Validation in Bouncy Castle The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library …	1.48 Vulnerable
GHSA-r9ch-m4fh-fc7q Aliases: CVE-2016-1000341	Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature …	1.56 Vulnerable 1.56 Vulnerable
GHSA-qcj7-g2j5-g7r3 Aliases: CVE-2016-1000342	In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification In the Bouncy Castle …	1.56 Vulnerable 1.56 Vulnerable
GHSA-2j2x-hx4g-2gf4 Aliases: CVE-2016-1000344	In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode In the Bouncy Castle JCE Provider …	1.56 Vulnerable 1.56 Vulnerable
GHSA-fjqm-246c-mwqg Aliases: CVE-2016-1000346	In Bouncy Castle JCE Provider the other party DH public key is not fully validated In the Bouncy Castle JCE …	1.56 Vulnerable 1.56 Vulnerable
GHSA-rrvx-pwf8-p59p Aliases: CVE-2016-1000343	In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values …	1.56 Vulnerable 1.56 Vulnerable
GHSA-c8xf-m4ff-jcxj Aliases: CVE-2016-1000339	Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 In the Bouncy Castle JCE Provider version 1.55 and earlier the primary …	1.56 Vulnerable 1.56 Vulnerable
GHSA-xqj7-j8j5-f2xr Aliases: CVE-2018-1000180	Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator Bouncy Castle BC 1.54 - 1.59, …	1.60 Vulnerable 1.60 Vulnerable
GHSA-9gp4-qrff-c648 Aliases: CVE-2016-1000345	Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES …	1.56 Vulnerable 1.56 Vulnerable
GHSA-w285-wf9q-5w69 Aliases: CVE-2016-1000352	In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode In the Bouncy Castle JCE Provider …	1.56 Vulnerable 1.56 Vulnerable
GHSA-v435-xc8x-wvr9 Aliases: CVE-2024-30171	Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") An issue was discovered in Bouncy Castle …	There are no reported fixed by versions.
GHSA-8xfc-gm6g-vgpv Aliases: CVE-2024-29857	Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. An issue was discovered in ECCurve.java and ECCurve.cs …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	3.4