Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2016-1000346 →
DEBIAN-CVE-2016-1000346
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
bouncycastle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56-1"}]}]
Debian:13
bouncycastle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56-1"}]}]
Debian:14
bouncycastle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56-1"}]}]
Références
- advisory security-tracker.debian.org