CVE-2016-1000342 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2016-1000342 Interim 1 28 2025-11-05T04:12:01Z current 2021-05-30T13:49:53Z 2025-11-05T04:12:01Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2016-1000342 In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XGEAWJKZD7OQVIJASTYVQUZP47CE6G52/#XGEAWJKZD7OQVIJASTYVQUZP47CE6G52 E-Mail link for openSUSE-SU-2018:1689-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP5 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 openSUSE Tumbleweed bouncycastle bouncycastle-1.64-1.63 bouncycastle-1.64-3.3.1 bouncycastle-1.68-3.2 bouncycastle-1.72-150200.3.12.1 bouncycastle-1.77-150200.3.24.1 bouncycastle-1.79-150200.3.32.2 bouncycastle-1.80-160000.2.2 bouncycastle-javadoc-1.68-3.2 bouncycastle-javadoc-1.80-160000.2.2 bouncycastle-jmail-1.80-160000.2.2 bouncycastle-mail-1.68-3.2 bouncycastle-mail-1.80-160000.2.2 bouncycastle-pg bouncycastle-pg-1.64-1.63 bouncycastle-pg-1.64-3.3.1 bouncycastle-pg-1.68-3.2 bouncycastle-pg-1.72-150200.3.12.1 bouncycastle-pg-1.77-150200.3.24.1 bouncycastle-pg-1.79-150200.3.32.2 bouncycastle-pg-1.80-160000.2.2 bouncycastle-pkix-1.68-3.2 bouncycastle-pkix-1.72-150200.3.12.1 bouncycastle-pkix-1.77-150200.3.24.1 bouncycastle-pkix-1.79-150200.3.32.2 bouncycastle-pkix-1.80-160000.2.2 bouncycastle-tls-1.68-3.2 bouncycastle-tls-1.80-160000.2.2 bouncycastle-util-1.72-150200.3.12.1 bouncycastle-util-1.77-150200.3.24.1 bouncycastle-util-1.79-150200.3.32.2 bouncycastle-util-1.80-160000.2.2 bouncycastle-1.64-1.63 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 bouncycastle-pg-1.64-1.63 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 bouncycastle-1.64-1.63 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 bouncycastle-pg-1.64-1.63 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 bouncycastle-1.64-3.3.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 bouncycastle-pg-1.64-3.3.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 bouncycastle-1.72-150200.3.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 bouncycastle-pg-1.72-150200.3.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 bouncycastle-pkix-1.72-150200.3.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 bouncycastle-util-1.72-150200.3.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 bouncycastle-1.77-150200.3.24.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 bouncycastle-pg-1.77-150200.3.24.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 bouncycastle-pkix-1.77-150200.3.24.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 bouncycastle-util-1.77-150200.3.24.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 bouncycastle-1.79-150200.3.32.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 bouncycastle-pg-1.79-150200.3.32.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 bouncycastle-pkix-1.79-150200.3.32.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 bouncycastle-util-1.79-150200.3.32.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 bouncycastle-1.80-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 bouncycastle-javadoc-1.80-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 bouncycastle-jmail-1.80-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 bouncycastle-mail-1.80-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 bouncycastle-pg-1.80-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 bouncycastle-pkix-1.80-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 bouncycastle-tls-1.80-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 bouncycastle-util-1.80-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 bouncycastle-1.68-3.2 as a component of openSUSE Tumbleweed bouncycastle-javadoc-1.68-3.2 as a component of openSUSE Tumbleweed bouncycastle-mail-1.68-3.2 as a component of openSUSE Tumbleweed bouncycastle-pg-1.68-3.2 as a component of openSUSE Tumbleweed bouncycastle-pkix-1.68-3.2 as a component of openSUSE Tumbleweed bouncycastle-tls-1.68-3.2 as a component of openSUSE Tumbleweed bouncycastle as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 bouncycastle-pg as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure. CVE-2016-1000342 SUSE Linux Enterprise Module for Development Tools 15 SP2:bouncycastle-1.64-1.63 SUSE Linux Enterprise Module for Development Tools 15 SP2:bouncycastle-pg-1.64-1.63 SUSE Linux Enterprise Module for Development Tools 15 SP3:bouncycastle-1.64-1.63 SUSE Linux Enterprise Module for Development Tools 15 SP3:bouncycastle-pg-1.64-1.63 SUSE Linux Enterprise Module for Development Tools 15 SP4:bouncycastle-1.64-3.3.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:bouncycastle-pg-1.64-3.3.1 SUSE Linux Enterprise Module for Development Tools 15 SP5:bouncycastle-1.72-150200.3.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP5:bouncycastle-pg-1.72-150200.3.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP5:bouncycastle-pkix-1.72-150200.3.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP5:bouncycastle-util-1.72-150200.3.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:bouncycastle-1.77-150200.3.24.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:bouncycastle-pg-1.77-150200.3.24.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:bouncycastle-pkix-1.77-150200.3.24.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:bouncycastle-util-1.77-150200.3.24.1 SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-1.79-150200.3.32.2 SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pg-1.79-150200.3.32.2 SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-pkix-1.79-150200.3.32.2 SUSE Linux Enterprise Module for Development Tools 15 SP7:bouncycastle-util-1.79-150200.3.32.2 SUSE Linux Enterprise Server 16.0:bouncycastle-1.80-160000.2.2 SUSE Linux Enterprise Server 16.0:bouncycastle-javadoc-1.80-160000.2.2 SUSE Linux Enterprise Server 16.0:bouncycastle-jmail-1.80-160000.2.2 SUSE Linux Enterprise Server 16.0:bouncycastle-mail-1.80-160000.2.2 SUSE Linux Enterprise Server 16.0:bouncycastle-pg-1.80-160000.2.2 SUSE Linux Enterprise Server 16.0:bouncycastle-pkix-1.80-160000.2.2 SUSE Linux Enterprise Server 16.0:bouncycastle-tls-1.80-160000.2.2 SUSE Linux Enterprise Server 16.0:bouncycastle-util-1.80-160000.2.2 openSUSE Tumbleweed:bouncycastle-1.68-3.2 openSUSE Tumbleweed:bouncycastle-javadoc-1.68-3.2 openSUSE Tumbleweed:bouncycastle-mail-1.68-3.2 openSUSE Tumbleweed:bouncycastle-pg-1.68-3.2 openSUSE Tumbleweed:bouncycastle-pkix-1.68-3.2 openSUSE Tumbleweed:bouncycastle-tls-1.68-3.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:bouncycastle SUSE Linux Enterprise Module for Development Tools 15 SP2:bouncycastle-pg moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N