CVE-2016-1000343

Name	CVE-2016-1000343
Description	In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1418-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
bouncycastle (PTS)	jessie, jessie (lts)	1.49+dfsg-3+deb8u3	fixed
	stretch (security)	1.56-1+deb9u3	fixed
	stretch (lts), stretch	1.56-1+deb9u4	fixed
	buster (security), buster, buster (lts)	1.60-1+deb10u1	fixed
	bullseye	1.68-2	fixed
	bookworm	1.72-2	fixed
	sid, trixie	1.77-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
bouncycastle	source	wheezy	(unfixed)	end-of-life
bouncycastle	source	jessie	1.49+dfsg-3+deb8u3		DLA-1418-1
bouncycastle	source	(unstable)	1.56-1

https://github.com/bcgit/bc-java/commit/50a53068c094d6cff37659da33c9b4505becd389#diff-5578e61500abb2b87b300d3114bdfd7d