BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."

This update for bouncycastle fixes the following issues :

Version update to 1.60 :

  - CVE-2018-1000613: Use of Externally-ControlledInput to     Select Classes or Code (boo#1100694)

  - Release notes:
    http://www.bouncycastle.org/releasenotes.html

Version update to 1.59 :

  - CVE-2017-13098: Fix against Bleichenbacher oracle when     not using the lightweight APIs (boo#1072697).

  - Release notes:
    http://www.bouncycastle.org/releasenotes.html

The remote host is affected by an information disclosure vulnerability. The SSL/TLS service supports RSA key exchanges, and incorrectly leaks whether or not the RSA key exchange sent by a client was correctly formatted. This information can allow an attacker to decrypt previous SSL/TLS sessions or impersonate the server.

Note that this plugin does not attempt to recover an RSA ciphertext, however it sends a number of correct and malformed RSA ciphertexts as part of an SSL handshake and observes how the server responds.

This plugin attempts to discover the vulnerability in multiple ways, by not completing the handshake and by completing it incorrectly, as well as using a variety of cipher suites. Only the first method that finds the service to be vulnerable is reported.

This plugin requires report paranoia as some services will report as affected even though the issue is not exploitable.

This update for bouncycastle fixes the following issues :

Security issues fixed :

  - CVE-2018-1000613: Fix use of Externally-Controlled Input     to Select Classes or Code ('Unsafe Reflection')     (boo#1100694).

  - CVE-2017-13098: Fix against Bleichenbacher oracle when     not using the lightweight APIs (boo#1072697).

Security fixes for CVE-2017-13098 and CVE-2018-1000180

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bouncycastle to version 1.59 fixes the following issues :

These security issues were fixed :

  - CVE-2017-13098: BouncyCastle, when configured to use the     JCE (Java Cryptography Extension) for cryptographic     functions, provided a weak Bleichenbacher oracle when     any TLS cipher suite using RSA key exchange was     negotiated. An attacker can recover the private key from     a vulnerable application. This vulnerability is referred     to as 'ROBOT' (bsc#1072697).

  - CVE-2016-1000338: Ensure full validation of ASN.1     encoding of signature on verification. It was possible     to inject extra elements in the sequence making up the     signature and still have it validate, which in some     cases may have allowed the introduction of 'invisible'     data into a signed structure (bsc#1095722).

  - CVE-2016-1000339: Prevent AESEngine key information leak     via lookup table accesses (boo#1095853).

  - CVE-2016-1000340: Preventcarry propagation bugs in the     implementation of squaring for several raw math classes     (boo#1095854).

  - CVE-2016-1000341: Fix DSA signature generation     vulnerability to timing attack (boo#1095852).

  - CVE-2016-1000341: DSA signature generation was     vulnerable to timing attack. Where timings can be     closely observed for the generation of signatures may     have allowed an attacker to gain information about the     signature's k value and ultimately the private value as     well (bsc#1095852).

  - CVE-2016-1000342: Ensure that ECDSA does fully validate     ASN.1 encoding of signature on verification. It was     possible to inject extra elements in the sequence making     up the signature and still have it validate, which in     some cases may have allowed the introduction of     'invisible' data into a signed structure (bsc#1095850).

  - CVE-2016-1000343: Prevent weak default settings for     private DSA key pair generation (boo#1095849).

  - CVE-2016-1000344: Removed DHIES from the provider to     disable the unsafe usage of ECB mode (boo#1096026).

  - CVE-2016-1000345: The DHIES/ECIES CBC mode was     vulnerable to padding oracle attack. In an environment     where timings can be easily observed, it was possible     with enough observations to identify when the decryption     is failing due to padding (bsc#1096025).

  - CVE-2016-1000346: The other party DH public key was not     fully validated. This could have caused issues as     invalid keys could be used to reveal details about the     other party's private key where static Diffie-Hellman is     in use (bsc#1096024).

  - CVE-2016-1000352: Remove ECIES from the provider to     disable the unsafe usage of ECB mode (boo#1096022).

The Legion of the Bouncy Castle reports :

Release: 1.59

CVE-2017-13098 ('ROBOT'), a Bleichenbacher oracle in TLS when RSA key exchange is negotiated. This potentially affected BCJSSE servers and any other TLS servers configured to use JCE for the underlying crypto
- note the two TLS implementations using the BC lightweight APIs are not affected by this.

Hanno Boeck, Juraj Somorovsky and Craig Young discovered that the TLS implementation in Bouncy Castle is vulnerable to an adaptive chosen ciphertext attack against RSA keys.

ID	Name	Product	Family	Severity
136317	openSUSE Security Update : bouncycastle (openSUSE-2020-607)	Nessus	SuSE Local Security Checks	critical
105415	Return Of Bleichenbacher's Oracle Threat (ROBOT) Information Disclosure	Nessus	General	high
123233	openSUSE Security Update : bouncycastle (openSUSE-2019-546)	Nessus	SuSE Local Security Checks	critical
120804	Fedora 28 : bouncycastle (2018-ceced55c5e)	Nessus	Fedora Local Security Checks	high
111428	openSUSE Security Update : bouncycastle (openSUSE-2018-776)	Nessus	SuSE Local Security Checks	critical
110599	Fedora 27 : bouncycastle (2018-da9fe79871)	Nessus	Fedora Local Security Checks	high
110530	openSUSE Security Update : bouncycastle (openSUSE-2018-628)	Nessus	SuSE Local Security Checks	high
105502	FreeBSD : The Bouncy Castle Crypto APIs: CVE-2017-13098 ('ROBOT') (6a131fbf-ec76-11e7-aa65-001b216d295b)	Nessus	FreeBSD Local Security Checks	medium
105432	Debian DSA-4072-1 : bouncycastle - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-13098

medium

Tenable Plugins

critical

high

critical

high

critical

high

high

medium

medium