Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-1000180

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

Published

2018-06-05T13:29:00.203

Last Modified

2025-05-12T17:37:16.527

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-327
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application bouncycastle bc-java ≤ 1.59 Yes
Application bouncycastle fips_java_api ≤ 1.0.1 Yes
Operating System debian debian_linux 9.0 Yes
Application oracle api_gateway 11.1.2.4.0 Yes
Application oracle business_process_management_suite 11.1.1.9.0 Yes
Application oracle business_process_management_suite 12.1.3.0.0 Yes
Application oracle business_process_management_suite 12.2.1.3.0 Yes
Application oracle business_transaction_management 12.1.0 Yes
Application oracle communications_application_session_controller 3.7.1 Yes
Application oracle communications_application_session_controller 3.8.0 Yes
Application oracle communications_converged_application_server < 7.0.0.1 Yes
Application oracle communications_webrtc_session_controller < 7.2 Yes
Application oracle enterprise_repository 12.1.3.0.0 Yes
Application oracle managed_file_transfer 12.1.3.0.0 Yes
Application oracle managed_file_transfer 12.2.1.3.0 Yes
Application oracle peoplesoft_enterprise_peopletools 8.55 Yes
Application oracle peoplesoft_enterprise_peopletools 8.56 Yes
Application oracle peoplesoft_enterprise_peopletools 8.57 Yes
Application oracle retail_convenience_and_fuel_pos_software 2.8.1 Yes
Application oracle retail_xstore_point_of_service 7.0 Yes
Application oracle retail_xstore_point_of_service 7.1 Yes
Application oracle soa_suite 12.1.3.0.0 Yes
Application oracle soa_suite 12.2.1.3.0 Yes
Application oracle webcenter_portal 11.1.1.9.0 Yes
Application oracle webcenter_portal 12.2.1.3.0 Yes
Application oracle weblogic_server 12.1.3.0.0 Yes
Application netapp oncommand_workflow_automation - Yes
Operating System redhat virtualization 4.2 Yes
Application redhat jboss_enterprise_application_platform 7.1.0 Yes
Operating System redhat enterprise_linux 6.0 No
Operating System redhat enterprise_linux 7.0 No
References