Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade bouncycastle | Jun 23, 2018 | Jun 5, 2018 |
| Freebsd | — | Upgrade bouncycastle15Upgrade puppetserver6Upgrade puppetserverUpgrade bouncycastleUpgrade puppetserver5 | Jul 16, 2018 | Jul 15, 2018 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 28710939 for version 12.2.1.3.0. | Feb 27, 2019 | Jun 5, 2018 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 18, 2018 |
| Red_hat Jboss_eap | — | — | Nov 14, 2019 | Jun 5, 2018 |
| Suse | — | Upgrade bouncycastle-pgUpgrade bouncycastle | Sep 25, 2018 | Jun 5, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 5, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub