Hash Collision

🗓️ 22 Mar 2018 08:43:05Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 30 Views

Bouncy Castle vulnerable to 16-bit HMAC hash collisio

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from Bouncy Castle affects Platform PCM	24 Jun 201802:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Big Data Intelligence is affected by a Using Components with Known Vulnerabilities vulnerability	14 Oct 201916:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Bouncy Castle Java Cryptography affect IBM Tivoli Business Manager	30 Sep 202116:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by a Bouncy Castle vulnerability	28 Sep 201804:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	24 Aug 202010:03	–	ibm
IBM Security Bulletins	Security Bulletin: Public disclosed vulnerability from Bouncy Castle affects Platform HPC	24 Jun 201802:09	–	ibm
CNVD	Unspecified Vulnerability in Bouncy Castle BKS-V1	19 Apr 201800:00	–	cnvd
CVE	CVE-2018-5382	16 Apr 201813:00	–	cve
Cvelist	CVE-2018-5382 Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collisions	16 Apr 201813:00	–	cvelist
Debian CVE	CVE-2018-5382	16 Apr 201813:00	–	debiancve

Vulners

Node

bcprov-jdk15on bcprov-jdk15onMatch1.46java

OR

bcprov-jdk14 bcprov-jdk14Range1.38–1.46java

OR

bcprov-ext-jdk15on bcprov-ext-jdk15onMatch1.46java

OR

bcprov-ext-jdk14 bcprov-ext-jdk14Range1.45–1.46java

OR

bcprov-ext-jdk16 bcprov-ext-jdk16Range1.45–1.46java

OR

bcprov-jdk15 bcprov-jdk15Range1.32–1.46java

OR

bcpg-jdk15on bcpg-jdk15onMatch1.46java

OR

bcmail-jdk15on bcmail-jdk15onMatch1.46java

OR

bcprov-jdk14 bcprov-jdk14Range124–140java

OR

bcprov-ext-jdk15 bcprov-ext-jdk15Range1.43–1.46java

OR

bcmail-jdk14 bcmail-jdk14Range136–139java

OR

bcmail-jdk14 bcmail-jdk14Range1.38–1.46java

OR

bcprov-jdk15 bcprov-jdk15Range133–140java

OR

bcprov-jdk15 bcprov-jdk15Range1.32–138java

Source	Link
cryptosense	www.cryptosense.com/blog/bouncycastle-keystore-security/
github	www.github.com/bcgit/bc-java/blob/5fdb1face92f596300323c25cba9fe18726645e8/prov/src/main/java/org/bouncycastle/jcajce/provider/keystore/BC.java
insights	www.insights.sei.cmu.edu/cert/2018/03/the-curious-case-of-the-bouncy-castle-bks-passwords.html
securityfocus	www.securityfocus.com/bid/103453
bouncycastle	www.bouncycastle.org/releasenotes.html
oracle	www.oracle.com/security-alerts/cpuoct2020.html
kb	www.kb.cert.org/vuls/id/306792
access	www.access.redhat.com/errata/RHSA-2018:2927

20 Apr 2022 17:17Current

5.1Medium risk

Vulners AI Score5.1

CVSS 23.6

CVSS 3.14.4

EPSS0.00153

bouncy castle hash collision 16 bits hmac keystore vulnerability bks-v1 1.49 software integrity verification