Executive brief
Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator
Affected products
- Maven org.bouncycastle:bcprov-jdk14
- Maven org.bouncycastle:bcprov-jdk15on
- Maven org.bouncycastle:bcprov-jdk15
Junglewise Threat Intelligence
CVE-2018-1000180: Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator
CVE-2018-1000180 · Severity: low · CVSS 3 · Published 2018-10-16
Technologies: org.bouncycastle:bcprov-jdk14 (Maven), org.bouncycastle:bcprov-jdk15on (Maven), org.bouncycastle:bcprov-jdk15 (Maven). Vendors: Maven.
Related threats
- Bouncy Castle BC-JAVA timing channel in FrodoKEM
- Bouncy Castle BC-JAVA LDAP injection in LDAPStoreHelper
- Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
- Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
- Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")