CVE-2018-1000180
High
Description
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Bouncycastle Bc-java
PublishedJun 5, 2018
First seenJun 5, 2018
How to fix
Update
- oracle communications_converged_application_server7.0.0.1 or later
- oracle communications_webrtc_session_controller7.2 or later
- org.bouncycastle:bcprov-jdk141.60 or later
- org.bouncycastle:bcprov-jdk151.60 or later
- org.bouncycastle:bcprov-jdk15on1.60 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2018:2428
- access.redhat.com/errata/RHSA-2018:2669
- access.redhat.com/errata/RHSA-2018:2643
- access.redhat.com/errata/RHSA-2018:2424
- access.redhat.com/errata/RHSA-2018:2423
- access.redhat.com/errata/RHSA-2018:2425
- debian.org/security/2018/dsa-4233
- access.redhat.com/errata/RHSA-2019:0877
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bouncycastle bc-java | 1.54 ≤ v ≤ 1.59 | — |
| bouncycastle fips_java_api | v ≤ 1.0.1 | — |
| debian debian_linux | 9.0 | — |
| oracle api_gateway | 11.1.2.4.0 | — |
| oracle business_process_management_suite | 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0 | — |
| oracle business_transaction_management | 12.1.0 | — |
| oracle communications_application_session_controller | 3.7.1, 3.8.0 | — |
| oracle communications_converged_application_server | v < 7.0.0.1 | 7.0.0.1 |
| oracle communications_webrtc_session_controller | v < 7.2 | 7.2 |
| oracle enterprise_repository | 12.1.3.0.0 | — |
| oracle managed_file_transfer | 12.1.3.0.0, 12.2.1.3.0 | — |
| oracle peoplesoft_enterprise_peopletools | 8.55, 8.56, 8.57 | — |
| oracle retail_convenience_and_fuel_pos_software | 2.8.1 | — |
| oracle retail_xstore_point_of_service | 7.0, 7.1 | — |
| oracle soa_suite | 12.1.3.0.0, 12.2.1.3.0 | — |
| oracle webcenter_portal | 11.1.1.9.0, 12.2.1.3.0 | — |
| oracle weblogic_server | 12.1.3.0.0 | — |
| netapp oncommand_workflow_automation | No range specified | — |
| redhat virtualization | 4.2 | — |
| redhat jboss_enterprise_application_platform | 7.1.0 | — |
| org.bouncycastle:bcprov-jdk14Maven | v < 1.60 | 1.60 |
| org.bouncycastle:bcprov-jdk15Maven | v < 1.60 | 1.60 |
| org.bouncycastle:bcprov-jdk15onMaven | v < 1.60 | 1.60 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.