NetSight
IP …
high7.5

CVE-2018-1000180

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pai…

Impact

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

Affected products

VendorProductAffected versions
BouncycastleBc-Java
from 1.54 through 1.59
BouncycastleFips Java Api
through 1.0.1
DebianDebian Linux
Version 9.0
OracleApi Gateway
Version 11.1.2.4.0
OracleBusiness Process Management Suite
Versions 11.1.1.9.0, 12.1.3.0.0, 12.2.1.3.0
OracleBusiness Transaction Management
Version 12.1.0
OracleCommunications Application Session Controller
Versions 3.7.1, 3.8.0
OracleCommunications Converged Application Server
before 7.0.0.1
OracleCommunications Webrtc Session Controller
before 7.2
OracleEnterprise Repository
Version 12.1.3.0.0
OracleManaged File Transfer
Versions 12.1.3.0.0, 12.2.1.3.0
OraclePeoplesoft Enterprise Peopletools
Versions 8.55, 8.56, 8.57

Weakness classification

CWE-327

References