openSUSE: 2018:1689-1 Moderate: BouncyCastle Timing Issues and Fixes

This update for bouncycastle to version 1.59 fixes the following issues:

These security issues were fixed:

- CVE-2017-13098: BouncyCastle, when configured to use the JCE (Java

Cryptography Extension) for cryptographic functions, provided a weak

Bleichenbacher oracle when any TLS cipher suite using RSA key exchange

was negotiated. An attacker can recover the private key from a

vulnerable application. This vulnerability is referred to as "ROBOT"

(bsc#1072697).

- CVE-2016-1000338: Ensure full validation of ASN.1 encoding of signature

on verification. It was possible to inject extra elements in the

sequence making up the signature and still have it validate, which in

some cases may have allowed the introduction of 'invisible' data into a

signed structure (bsc#1095722).

- CVE-2016-1000339: Prevent AESEngine key information leak via lookup

table accesses (boo#1095853).

- CVE-2016-1000340: Preventcarry propagation bugs in...