Legion\-Of\-The\-Bouncy\-Castle\-Java\-Crytography\-Api

Repositories	https://github.com/bcgit/bc-java
#Vulnerabilities	5

Date	Id	Summary	Products	Score	Patch	Annotated
2018-06-01	CVE-2016-1000338	In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.	Legion\-Of\-The\-Bouncy\-Castle\-Java\-Crytography\-Api, Ubuntu_linux, 7\-Mode_transition_tool, Satellite, Satellite_capsule	7.5
2016-04-18	CVE-2016-2427	The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug 26234568. NOTE: The vendor disputes the existence of this potential issue in Android, stating "This CVE was raised in error: it referred to the authentication tag size in GCM, whose default according...	Legion\-Of\-The\-Bouncy\-Castle\-Java\-Crytography\-Api, Android	5.5