In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate…
Priority LOW 36CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 3 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.
Summary
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Why it matters now
EPSS 0.01794 78th percentileScored 2026-11-07
Fix Partial org.bouncycastle:bcprov-jdk14 (Maven): 1.56org.bouncycastle:bcprov-jdk15 (Maven): 1.56+1 more productRed Hat: 2 advisoriesRed Hat: 3 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.bouncycastle:bcprov-jdk14 (Maven) | 1.38 to before 1.56 | 1.56 | Patch available | GHSA-4vhj-98r6-424h |
| — | org.bouncycastle:bcprov-jdk15 (Maven) | 1.38 to before 1.56 | 1.56 | Patch available | GHSA-4vhj-98r6-424h |
| — | org.bouncycastle:bcprov-jdk15on (Maven) | 1.38 to before 1.56 | 1.56 | Patch available | GHSA-4vhj-98r6-424h |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.bouncycastle:bcprov-jdk14 (Maven) Vendor— Affected 1.38 to before 1.56 Fixed in 1.56 Patch available GHSA-4vhj-98r6-424h
- org.bouncycastle:bcprov-jdk15 (Maven) Vendor— Affected 1.38 to before 1.56 Fixed in 1.56 Patch available GHSA-4vhj-98r6-424h
- org.bouncycastle:bcprov-jdk15on (Maven) Vendor— Affected 1.38 to before 1.56 Fixed in 1.56 Patch available GHSA-4vhj-98r6-424h
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:*:*:*:*:*:*:*:* | 1.38 to before 1.56 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:redhat:satellite:6.4:-:*:*:*:*:*:* | 6.4 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Red Hat |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:*:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:*:*:*:*:*:*:*:* Versions 1.38 to before 1.56 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:redhat:satellite:6.4:-:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:satellite_capsule:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:*:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-4vhj-98r6-424h org.bouncycastle:bcprov-jdk14 (Maven) Fixed in 1.56 Advisory →
- Fix · GHSA-4vhj-98r6-424h org.bouncycastle:bcprov-jdk15 (Maven) Fixed in 1.56 Advisory →
- Fix · GHSA-4vhj-98r6-424h org.bouncycastle:bcprov-jdk15on (Maven) Fixed in 1.56 Advisory →
Red Hat 2 advisories
- RHSA-2018:2927 Released 2018-10-16 · Red Hat rating ImportantSatellite 6.4 security, bug fix, and enhancement update
- Red Hat Satellite 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, candlepin-2.4.8-1.el7 +47
- Red Hat Satellite Capsule 6.4 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.5-1.el7sat, createrepo_c-0.7.4-1.el7sat +47
- RHSA-2018:2669 Released 2018-09-11 · Red Hat rating ImportantFuse 7.1 security update
- Red Hat Fuse 7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Fixed | RHSA-2018:2669 |
| Red Hat Satellite 6.4 | Fixed | RHSA-2018:2927 |
| Red Hat Satellite Capsule 6.4 | Fixed | RHSA-2018:2927 |
Not affected: 8 products
- JBoss Developer Studio 11
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Fuse Integration Service 2
- Red Hat OpenShift Application Runtimes
- Red Hat Single Sign-On 7
- Red Hat Subscription Asset Manager
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2016-1000338
- 2026-10-03 Alias added: GHSA-4vhj-98r6-424h
- 2026-11-03 Fix available: Red Hat Fuse 7 · Red Hat
References
Advisory 8
- [debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update
- RHSA-2018:2669
- USN-3727-1
- RHSA-2018:2927
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20231006-0011/
- https://nvd.nist.gov/vuln/detail/CVE-2016-1000338
Sources
- CVE-2016-1000338 · CVE Program
- CVE-2016-1000338 · NVD
- FIRST EPSS
- GHSA-4vhj-98r6-424h · GitHub Advisory Database · CC BY 4.0
- CVE-2016-1000338 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences