CVE-2018-1000180: High severity bouncycastle FIPS Java API vulnerability

Q: What is the vulnerability ID of this security flaw?

The vulnerability ID of this security flaw is CVE-2018-1000180.

Q: What is the severity level of vulnerability CVE-2018-1000180?

The severity level of vulnerability CVE-2018-1000180 is high with a severity value of 7.5.

Q: What is the affected software for vulnerability CVE-2018-1000180?

The affected software for vulnerability CVE-2018-1000180 includes Bouncy Castle versions BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1, and earlier.

Q: How can I fix vulnerability CVE-2018-1000180?

To fix vulnerability CVE-2018-1000180, update to Bouncy Castle version 1.60 or later.

Q: Where can I find more information about vulnerability CVE-2018-1000180?

You can find more information about vulnerability CVE-2018-1000180 on the Bouncy Castle issue tracker and GitHub repositories.

Published Jun 5, 2018

Updated

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

Other sources

Bouncy Castle could provide weaker than expected security, caused by an error in the Low-level interface to RSA key pair generator. The RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. An attacker could exploit this vulnerability to launch further attacks on the system.

— IBM

Affected Software

37 affected componentsFixes available

debian/bouncycastle

1.60-11.60-1+deb10u11.68-21.72-2

redhat/bouncycastle<1.60

1.60

bouncycastle FIPS Java API<=1.0.1

bouncycastle Legion-of-the-bouncy-castle-java-crytography-api>=1.54<=1.59

Debian Debian Linux=9.0

Oracle API Gateway=11.1.2.4.0

Oracle Business Process Management Suite=11.1.1.9.0

Oracle Business Process Management Suite=12.1.3.0.0

Oracle Business Process Management Suite=12.2.1.3.0

Oracle Business Transaction Management=12.1.0

Oracle Communications Application Session Controller=3.7.1

Oracle Communications Application Session Controller=3.8.0

Oracle Communications Converged Application Server<7.0.0.1

Oracle Communications WebRTC Session Controller<7.2

Oracle Enterprise Repository=12.1.3.0.0

Oracle Managed File Transfer=12.1.3.0.0

Oracle Managed File Transfer=12.2.1.3.0

Oracle PeopleSoft Enterprise PeopleTools=8.55

Oracle PeopleSoft Enterprise PeopleTools=8.56

Oracle PeopleSoft Enterprise PeopleTools=8.57

Oracle Retail Convenience And Fuel Pos Software=2.8.1

Oracle Retail Xstore Point of Service=7.0

Oracle Retail Xstore Point of Service=7.1

Oracle SOA Suite=12.1.3.0.0

Oracle SOA Suite=12.2.1.3.0

Oracle WebCenter Portal=11.1.1.9.0

Oracle WebCenter Portal=12.2.1.3.0

Oracle WebLogic Server=12.1.3.0.0

NetApp OnCommand Workflow Automation

redhat Virtualization=4.2

redhat JBoss Enterprise Application Platform=7.1.0

redhat Enterprise Linux=6.0

redhat Enterprise Linux=7.0

bouncycastle bc-java>=1.54<=1.59

All of the following

redhat JBoss Enterprise Application Platform=7.1.0

Any of the following

redhat Enterprise Linux=6.0

redhat Enterprise Linux=7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/bouncycastle to a version that resolves this vulnerability.
Fixed in 1.60-1Fixed in 1.60-1+deb10u1Fixed in 1.68-2Fixed in 1.72-2
Upgrade
Upgrade redhat/bouncycastle to a version that resolves this vulnerability.
Fixed in 1.60
Upgrade
Upgrade Bouncy Castle BC to a version that resolves this vulnerability.
Fixed in 1.60 beta 4
Upgrade
Upgrade Bouncy Castle BC-FJA to a version that resolves this vulnerability.
Fixed in 1.0.2

Event History

Jun 5, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

Description

Sep 6, 2022

Data Sourced

via IBM·12:00 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-6615289

Frequently Asked Questions

What is the vulnerability ID of this security flaw?