MGASA-2018-0376 - Updated bouncycastle packages fix security vulnerabilities

Publication date: 20 Sep 2018
URL: https://advisories.mageia.org/MGASA-2018-0376.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2016-1000338,
     CVE-2016-1000339,
     CVE-2016-1000340,
     CVE-2016-1000341,
     CVE-2016-1000342,
     CVE-2016-1000343,
     CVE-2016-1000344,
     CVE-2016-1000345,
     CVE-2016-1000346,
     CVE-2016-1000352,
     CVE-2017-13098,
     CVE-2018-1000180,
     CVE-2018-1000613

Updated bouncycastle packages fix security vulnerabilities:

Ensure full validation of ASN.1 encoding of signature on verification.
It was possible to inject extra elements in the sequence making up the
signature and still have it validate, which in some cases may have
allowed the introduction of 'invisible' data into a signed structure
(CVE-2016-1000338).

Prevent AESEngine key information leak via lookup table accesses
(CVE-2016-1000339).

Preventcarry propagation bugs in the implementation of squaring for
several raw math classes (CVE-2016-1000340).

DSA signature generation was vulnerable to timing attack. Where timings
can be closely observed for the generation of signatures may have allowed
an attacker to gain information about the signature's k value and
ultimately the private value as well (CVE-2016-1000341).

Ensure that ECDSA does fully validate ASN.1 encoding of signature on
verification. It was possible to inject extra elements in the sequence
making up the signature and still have it validate, which in some cases
may have allowed the introduction of 'invisible' data into a signed
structure (CVE-2016-1000342).

Prevent weak default settings for private DSA key pair generation
(CVE-2016-1000343).

Removed DHIES from the provider to disable the unsafe usage of ECB mode
(CVE-2016-1000344).

The DHIES/ECIES CBC mode was vulnerable to padding oracle attack. In an
environment where timings can be easily observed, it was possible with
enough observations to identify when the decryption is failing due to
padding (CVE-2016-1000345).

The other party DH public key was not fully validated. This could have
caused issues as invalid keys could be used to reveal details about the
other party's private key where static Diffie-Hellman is in use
(CVE-2016-1000346).

Remove ECIES from the provider to disable the unsafe usage of ECB mode
(CVE-2016-1000352).

BouncyCastle, when configured to use the JCE (Java Cryptography Extension)
for cryptographic functions, provided a weak Bleichenbacher oracle when
any TLS cipher suite using RSA key exchange was negotiated. An attacker
can recover the private key from a vulnerable application. This
vulnerability is referred to as "ROBOT" (CVE-2017-13098).

It was discovered that the low-level interface to the RSA key pair
generator of Bouncy Castle (a Java implementation of cryptographic
algorithms) could perform less Miller-Rabin primality tests than expected
(CVE-2018-1000180).

Fix use of Externally-Controlled Input to Select Classes or Code
('Unsafe Reflection') (CVE-2018-1000613).

References:
- https://bugs.mageia.org/show_bug.cgi?id=22197
- https://www.debian.org/security/2018/dsa-4233
- - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000338
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000339
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000340
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000341
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000342
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000343
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000344
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000345
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000346
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000352
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13098
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000180
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000613

SRPMS:
- 6/core/bouncycastle-1.60-1.mga6