PT-2018-16936 · Legion Of The Bouncy Castle · Bouncy Castle

CVE-2018-5382 · Publicado 2018-04-16 · Atualizado 2025-05-12

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle versions prior to 1.47

Description The default BKS keystore uses an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. This issue applies to any BKS keystore generated prior to Bouncy Castle release 1.47. A new keystore type "BKS-V1" was introduced in version 1.49 for legacy reasons, but its use is discouraged by the library authors due to security concerns.

Recommendations For versions prior to 1.47, update to version 1.47 or later to use the new BKS format with a 160 bit HMAC. As a temporary workaround, consider avoiding the use of BKS keystores generated prior to version 1.47, especially in situations where the integrity of the keystore is crucial.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

CWE-354

Identificadores relacionados

CVE-2018-5382

GHSA-8477-3V39-GGPM

RHSA-2018:2927

Produtos afetados

Bouncy Castle

Referências · 15

• https://oracle.com/security-alerts/cpuoct2020.html · Nota
• http://securityfocus.com/bid/103453 · Nota
• https://osv.dev/vulnerability/CVE-2018-5382 · Aviso do Fabricante
• https://bouncycastle.org/releasenotes.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8477-3v39-ggpm · Aviso do Fabricante
• https://t.me/cvenotify/121778 · Publicação no Telegram
• https://security-tracker.debian.org/tracker/CVE-2018-5382 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5382 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:2927 · Aviso do Fabricante
• https://insights.sei.cmu.edu/cert/2018/03/the-curious-case-of-the-bouncy-castle-bks-passwords.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-5382 · Aviso do Fabricante
• https://kb.cert.org/vuls/id/306792 · Nota
• https://cve.org/CVERecord?id=CVE-2018-5382 · Nota de Segurança
• https://ubuntu.com/security/CVE-2018-5382 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5382 · Aviso do Fabricante