PT-2022-6901 · Bouncy Castle+1 · Bouncy Castle Bc-Fja+1

Published 2022-11-21 · Updated 2024-02-13 · CVE-2022-45146

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle BC-FJA versions prior to 1.0.2.4

Description An issue in the FIPS Java API of Bouncy Castle BC-FJA is triggered by changes to the JVM garbage collector in Java 13 and later. This issue causes temporary keys used by the module to be zeroed out while still in use, resulting in errors or potential information loss. FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.

Recommendations For Bouncy Castle BC-FJA versions prior to 1.0.2.4, update to version 1.0.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of Java versions 13 and later with the BC-FJA FIPS modules until the update is applied.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-05435

CVE-2022-45146

GHSA-68M8-V89J-7J2P

Affected Products

Bouncy Castle Bc-Fja

Java

References · 14

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE-2022-45146 · Exploit
• https://bdu.fstec.ru/vul/2023-05435 · Security Note
• https://ubuntu.com/security/CVE-2022-45146 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68m8-v89j-7j2p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45146 · Security Note
• https://bouncycastle.org/latest_releases.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-45146 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-45146 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45146 · Vendor Advisory
• https://t.me/cvenotify/38129 · Telegram Post
• https://t.me/cibsecurity/53234 · Telegram Post
• https://t.me/cvenotify/71296 · Telegram Post
• https://mvnrepository.com/artifact/org.bouncycastle/bc-fips · Note
• https://vuldb.com/ru/?id.214057 · Note