Bug 1095854 - (CVE-2016-1000340) VUL-0: CVE-2016-1000340: bouncycastle: In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bugwas introduced in the implementation of squaring for several raw math classeshave been fixed (org.bouncycastle.math.raw.Nat???). Thes
(CVE-2016-1000340)
VUL-0: CVE-2016-1000340: bouncycastle: In the Bouncy Castle JCE Provider vers...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/207117/
CVSSv3:RedHat:CVE-2016-1000340:2.9:(A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-06-04 15:34 UTC by Marcus Meissner
Modified: 2020-04-23 15:32 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2018-06-04 15:34:36 UTC
CVE-2016-1000340

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug
was introduced in the implementation of squaring for several raw math classes
have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by
our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**),
so there was the possibility of rare (in general usage) spurious calculations
for elliptic curve scalar multiplications. Such errors would have been detected
with high probability by the output validation for our scalar multipliers.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1000340
https://github.com/bcgit/bc-java/commit/790642084c4e0cadd47352054f868cc8397e2c00#diff-e5934feac8203ca0104ab291a3560a31
Comment 1 Swamp Workflow Management 2018-06-06 10:30:33 UTC
This is an autogenerated message for OBS integration:
This bug (1095854) was mentioned in
https://build.opensuse.org/request/show/614511 42.3 / bouncycastle
Comment 2 Swamp Workflow Management 2018-06-14 10:09:04 UTC
openSUSE-SU-2018:1689-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1072697,1095722,1095849,1095850,1095852,1095853,1095854,1096022,1096024,1096025,1096026
CVE References: CVE-2016-1000338,CVE-2016-1000339,CVE-2016-1000340,CVE-2016-1000341,CVE-2016-1000342,CVE-2016-1000343,CVE-2016-1000344,CVE-2016-1000345,CVE-2016-1000346,CVE-2016-1000352,CVE-2017-13098
Sources used:
openSUSE Leap 42.3 (src):    bouncycastle-1.59-23.3.1
Comment 3 Swamp Workflow Management 2018-07-19 11:10:25 UTC
This is an autogenerated message for OBS integration:
This bug (1095854) was mentioned in
https://build.opensuse.org/request/show/624022 Factory / bouncycastle
Comment 4 Swamp Workflow Management 2018-09-14 15:30:26 UTC
This is an autogenerated message for OBS integration:
This bug (1095854) was mentioned in
https://build.opensuse.org/request/show/635779 15.0 / bouncycastle
Comment 5 Alexandros Toptsoglou 2020-04-23 15:32:13 UTC
Leap 15.1 is not affected