View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2016-1000338 severity important: SUSE including 32 source package names (bouncycastle, bouncycastle-1.64-1.63, …), 34 product×package rows across 8 product lines (SUSE Linux Enterprise Module for Development Tools 15 SP2, SUSE Linux Enterprise Module for Development Tools 15 SP3, … (8 product lines)): Fixed 32, Known Not Affected 2.
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.