PT-2007-1141 · Bouncy Castle+2 · Bouncy Castle Bc-Fja+3

Publicado 2007-04-10 · Atualizado 2024-06-15 · CVE-2018-1000180

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Bouncy Castle versions 1.54 through 1.59 Bouncy Castle BC-FJA versions 1.0.0 through 1.0.1

Description: The issue is related to a flaw in the low-level interface to RSA key pair generator in Bouncy Castle. Specifically, RSA key pairs generated using the low-level API may have fewer Miller-Rabin tests than expected, potentially allowing an attacker to gain unauthorized access to protected data. This could be exploited remotely using network protocols such as HTTP or HTTPS.

Recommendations: For Bouncy Castle versions 1.54 through 1.59, update to version 1.60 beta 4 or later. For Bouncy Castle BC-FJA versions 1.0.0 through 1.0.1, update to version 1.0.2 or later.

Exploit

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-310

CWE-327

Identificadores relacionados

BDU:2019-00323

CVE-2018-1000180

DSA-4233-1

GHSA-XQJ7-J8J5-F2XR

MGASA-2018-0376

OPENSUSE-SU-2018_2820-1

OPENSUSE-SU-2024:10661-1

RHSA-2018:2423

RHSA-2018:2424

RHSA-2018:2643

Produtos afetados

Bouncy Castle

Bouncy Castle Bc-Fja

Oracle Weblogic Server

Suse

Referências · 66

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE-2018-1000180 · Exploit
• https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839 · Correção
• https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad · Correção
• https://packages.debian.org/src:bouncycastle · Nota
• https://ubuntu.com/security/CVE-2018-1000180 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2428 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2423 · Aviso do Fabricante
• https://github.com/advisories/GHSA-xqj7-j8j5-f2xr · Nota
• https://suse.com/security/cve/CVE-2018-1000180 · Nota
• https://access.redhat.com/errata/RHSA-2019:0877 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1000180.html · Nota
• https://bouncycastle.org/jira/browse/BJA-694 · Nota
• https://osv.dev/vulnerability/GHSA-xqj7-j8j5-f2xr · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2018-1000180 · Nota
• https://suse.com/security/cve/CVE-2016-1000344 · Nota