Description

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

Remediation

References

https://access.redhat.com/errata/RHSA-2018:2669

https://access.redhat.com/errata/RHSA-2018:2927

https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f

https://security.netapp.com/advisory/ntap-20181127-0004/

https://www.oracle.com/security-alerts/cpuoct2020.html

Related Vulnerabilities

CVE-2021-27568 Vulnerability in maven package net.minidev:json-smart

CVE-2021-21423 Vulnerability in npm package projen

CVE-2021-21119 Vulnerability in maven package org.webjars.npm:electron

CVE-2023-32695 Vulnerability in npm package socket.io-parser

CVE-2020-4051 Vulnerability in npm package dijit

Severity

High

Classification

CWE-310 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Tags

Patch Third Party Advisory