CVE-2022-45146
Medium
Description
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
SeverityMedium
CVSS5.5
Exploit probability—
ProductBouncycastle Fips Java Api
PublishedNov 21, 2022
First seenNov 21, 2022
How to fix
Update
- bouncycastle fips_java_api1.0.2.4 or later
- org.bouncycastle:bc-fips1.0.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bouncycastle fips_java_api | v < 1.0.2.4 | 1.0.2.4 |
| org.bouncycastle:bc-fipsMaven | v < 1.0.2.4 | 1.0.2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.