UBUNTU-CVE-2016-1000343

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.

References

Affected packages

Ubuntu:14.04:LTS / bouncycastle

Package

Name: bouncycastle
Purl: pkg:deb/ubuntu/bouncycastle@1.49+dfsg-2ubuntu0.1?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.49+dfsg-2ubuntu0.1

Affected versions

1.*

1.48+dfsg-2

1.49+dfsg-2

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "1.49+dfsg-2ubuntu0.1",
            "binary_name": "libbcmail-java"
        },
        {
            "binary_version": "1.49+dfsg-2ubuntu0.1",
            "binary_name": "libbcpg-java"
        },
        {
            "binary_version": "1.49+dfsg-2ubuntu0.1",
            "binary_name": "libbcpkix-java"
        },
        {
            "binary_version": "1.49+dfsg-2ubuntu0.1",
            "binary_name": "libbcprov-java"
        }
    ],
    "availability": "No subscription required"
}

Ubuntu:16.04:LTS / bouncycastle

Package

Name: bouncycastle
Purl: pkg:deb/ubuntu/bouncycastle@1.51-4ubuntu1?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.49+dfsg-3ubuntu1

1.51-4ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "1.51-4ubuntu1",
            "binary_name": "libbcmail-java"
        },
        {
            "binary_version": "1.51-4ubuntu1",
            "binary_name": "libbcpg-java"
        },
        {
            "binary_version": "1.51-4ubuntu1",
            "binary_name": "libbcpkix-java"
        },
        {
            "binary_version": "1.51-4ubuntu1",
            "binary_name": "libbcprov-java"
        }
    ]
}