PT-2007-1141 · Bouncy Castle+2 · Bouncy Castle Bc-Fja+3

Published 2007-04-10 · Updated 2024-06-15 · CVE-2018-1000180

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Bouncy Castle versions 1.54 through 1.59 Bouncy Castle BC-FJA versions 1.0.0 through 1.0.1

Description: The issue is related to a flaw in the low-level interface to RSA key pair generator in Bouncy Castle. Specifically, RSA key pairs generated using the low-level API may have fewer Miller-Rabin tests than expected, potentially allowing an attacker to gain unauthorized access to protected data. This could be exploited remotely using network protocols such as HTTP or HTTPS.

Recommendations: For Bouncy Castle versions 1.54 through 1.59, update to version 1.60 beta 4 or later. For Bouncy Castle BC-FJA versions 1.0.0 through 1.0.1, update to version 1.0.2 or later.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-310

CWE-327

Related Identifiers

BDU:2019-00323

CVE-2018-1000180

DSA-4233-1

GHSA-XQJ7-J8J5-F2XR

MGASA-2018-0376

OPENSUSE-SU-2018_2820-1

OPENSUSE-SU-2024:10661-1

RHSA-2018:2423

RHSA-2018:2424

RHSA-2018:2643

Affected Products

Bouncy Castle

Bouncy Castle Bc-Fja

Oracle Weblogic Server

Suse

References · 66

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE-2018-1000180 · Exploit
• https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839 · Patch
• https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad · Patch
• https://ubuntu.com/security/CVE-2018-1000180 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2428 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2423 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0877 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xqj7-j8j5-f2xr · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Patch
• https://access.redhat.com/errata/RHSA-2018:2425 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000180 · Security Note
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Patch
• https://access.redhat.com/errata/RHSA-2018:2643 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000180 · Vendor Advisory
• https://debian.org/security/2018/dsa-4233 · Vendor Advisory