CVE-2022-45146: Use After Free
First published: Mon Nov 21 2022(Updated: )
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bouncycastle Fips Java Api | <1.0.2.4 | |
| Oracle JDK | >=13.0.0 | |
| All of | ||
| Bouncycastle Fips Java Api | <1.0.2.4 | |
| Oracle JDK | >=13.0.0 | |
| maven/org.bouncycastle:bc-fips | <1.0.2.4 | 1.0.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-45146?
CVE-2022-45146 is a vulnerability found in the FIPS Java API of Bouncy Castle BC-FJA before version 1.0.2.4.
What is the severity of CVE-2022-45146?
The severity of CVE-2022-45146 is medium, with a CVSS score of 5.5.
How does CVE-2022-45146 affect Bouncy Castle BC-FJA?
CVE-2022-45146 affects Bouncy Castle BC-FJA before version 1.0.2.4, where changes to the JVM garbage collector in Java 13 and later can cause temporary keys used by the module to be zeroed out while still in use.
How can I fix CVE-2022-45146?
To fix CVE-2022-45146, update the Bouncy Castle BC-FJA to version 1.0.2.4 or later.
Are Oracle JDK versions vulnerable to CVE-2022-45146?
No, Oracle JDK versions are not vulnerable to CVE-2022-45146.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-68m8-v89j-7j2p
- alias/CVE-2022-45146
- collector/nvd-cve
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- collector/github-advisory
- vendor/bouncycastle
- canonical/bouncycastle fips java api
- vendor/oracle
- canonical/oracle jdk
- version/oracle jdk/13.0.0
- package-manager/maven