Lucene search

[email protected]CVE-2018-1000180

HistoryJun 05, 2018 - 1:29 p.m.

CVE-2018-1000180

2018-06-0513:29:00

CWE-327

[email protected]

web.nvd.nist.gov

139

cve

bouncy castle

rsa key pair generator

vulnerability

nvd

security

flaw

update

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8.2 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.005 Low

EPSS

Percentile

76.9%

JSON

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

CPENameOperatorVersion
bouncycastle:fips_java_apibouncycastle fips java apile1.0.1
bouncycastle:legion-of-the-bouncy-castle-java-crytography-apibouncycastle legion-of-the-bouncy-castle-java-crytography-apile1.59
debian:debian_linuxdebian debian linuxeq9.0
oracle:retail_xstore_point_of_serviceoracle retail xstore point of serviceeq7.1
oracle:api_gatewayoracle api gatewayeq11.1.2.4.0
oracle:weblogic_serveroracle weblogic servereq12.1.3.0.0
oracle:enterprise_repositoryoracle enterprise repositoryeq12.1.3.0.0
oracle:retail_xstore_point_of_serviceoracle retail xstore point of serviceeq7.0
oracle:peoplesoft_enterprise_peopletoolsoracle peoplesoft enterprise peopletoolseq8.55
oracle:peoplesoft_enterprise_peopletoolsoracle peoplesoft enterprise peopletoolseq8.56

CPE	Name	Operator	Version
bouncycastle:fips_java_api	bouncycastle fips java api	le	1.0.1
bouncycastle:legion-of-the-bouncy-castle-java-crytography-api	bouncycastle legion-of-the-bouncy-castle-java-crytography-api	le	1.59
debian:debian_linux	debian debian linux	eq	9.0
oracle:retail_xstore_point_of_service	oracle retail xstore point of service	eq	7.1
oracle:api_gateway	oracle api gateway	eq	11.1.2.4.0
oracle:weblogic_server	oracle weblogic server	eq	12.1.3.0.0
oracle:enterprise_repository	oracle enterprise repository	eq	12.1.3.0.0
oracle:retail_xstore_point_of_service	oracle retail xstore point of service	eq	7.0
oracle:peoplesoft_enterprise_peopletools	oracle peoplesoft enterprise peopletools	eq	8.55
oracle:peoplesoft_enterprise_peopletools	oracle peoplesoft enterprise peopletools	eq	8.56