CVE-2018-5382

🗓️ 16 Apr 2018 13:00:00Reported by Debian Security Bug TrackerType

The default BKS keystore uses a 16 bit HMAC, but Bouncy Castle 1.47 changes it to a 160 bit HMAC. "BKS-V1" is introduced for legacy reasons

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from Bouncy Castle affects Platform PCM	24 Jun 201802:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Big Data Intelligence is affected by a Using Components with Known Vulnerabilities vulnerability	14 Oct 201916:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Bouncy Castle Java Cryptography affect IBM Tivoli Business Manager	30 Sep 202116:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by a Bouncy Castle vulnerability	28 Sep 201804:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	24 Aug 202010:03	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from Bouncy Castle affects Platform HPC	24 Jun 201802:09	–	ibm
CNVD	Unspecified Vulnerability in Bouncy Castle BKS-V1	19 Apr 201800:00	–	cnvd
CVE	CVE-2018-5382	16 Apr 201813:00	–	cve
Cvelist	CVE-2018-5382 Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions	16 Apr 201813:00	–	cvelist
EUVD	EUVD-2022-3099	3 Oct 202520:07	–	euvd

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	11	any	bouncycastle	1.48+dfsg-2	bouncycastle_1.48+dfsg-2_any.deb
Debian	12	any	bouncycastle	1.48+dfsg-2	bouncycastle_1.48+dfsg-2_any.deb
Debian	13	any	bouncycastle	1.48+dfsg-2	bouncycastle_1.48+dfsg-2_any.deb
Debian	14	any	bouncycastle	1.48+dfsg-2	bouncycastle_1.48+dfsg-2_any.deb
Debian	999	any	bouncycastle	1.48+dfsg-2	bouncycastle_1.48+dfsg-2_any.deb

16 Apr 2018 13:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 23.6

CVSS 3.14.4

EPSS0.00262