CVE-2016-1000338

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification

published June 1, 2018

CVSS
—
EPSS
2%
Percentile
78.2
In the wild
Unconfirmed
What it is

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01794 · 78.2th percentile
Published
2018-06-01T00:00Z
EPSS history
Timeline
  • 01 JUN 00:00Z
    In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification
    cvelistv5