CVE-2018-1000180

Published: Jun 5, 2018Modified: May 12, 2025

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

Affected (29)

Products: Bouncycastle: Bc Java, Fips Java Api · Debian: Debian Linux · Oracle: Api Gateway, Business Process Management Suite, Business Transaction Management, Communications Application Session Controller, Communications Converged Application Server, Communications Webrtc Session Controller, Enterprise Repository, Managed File Transfer, Peoplesoft Enterprise Peopletools, Retail Convenience And Fuel Pos Software, Retail Xstore Point Of Service, Soa Suite, Webcenter Portal, Weblogic Server · +2 more

Show all products

2 products

1 product

14 products

Business Process Management Suite

Business Transaction Management

Communications Application Session Controller

Communications Converged Application Server

Communications Webrtc Session Controller

Enterprise Repository

Managed File Transfer

Peoplesoft Enterprise Peopletools

Retail Convenience And Fuel Pos Software

Retail Xstore Point Of Service

1 product

Oncommand Workflow Automation

Redhat

2 products

Virtualization

Jboss Enterprise Application Platform

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Bouncycastle Bc Java	From 1.54 to 1.59
Bouncycastle Fips Java Api	Up to 1.0.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration C

23 vulnerable

Vulnerable Software	Affected Versions
Oracle Api Gateway	Version 11.1.2.4.0
Oracle Business Process Management Suite	Version 11.1.1.9.0
Oracle Business Process Management Suite	Version 12.1.3.0.0
Oracle Business Process Management Suite	Version 12.2.1.3.0
Oracle Business Transaction Management	Version 12.1.0
Oracle Communications Application Session Controller	Version 3.7.1
Oracle Communications Application Session Controller	Version 3.8.0
Oracle Communications Converged Application Server	Before 7.0.0.1
Oracle Communications Webrtc Session Controller	Before 7.2
Oracle Enterprise Repository	Version 12.1.3.0.0
Oracle Managed File Transfer	Version 12.1.3.0.0
Oracle Managed File Transfer	Version 12.2.1.3.0
Oracle Peoplesoft Enterprise Peopletools	Version 8.55
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Retail Convenience And Fuel Pos Software	Version 2.8.1
Oracle Retail Xstore Point Of Service	Version 7.0
Oracle Retail Xstore Point Of Service	Version 7.1
Oracle Soa Suite	Version 12.1.3.0.0
Oracle Soa Suite	Version 12.2.1.3.0
Oracle Webcenter Portal	Version 11.1.1.9.0
Oracle Webcenter Portal	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.1.3.0.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand Workflow Automation	All versions

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Virtualization	Version 4.2

Configuration F

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.1.0

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0

Related CWEs

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

References (42)

http://www.securityfocus.com/bid/106567

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:2423

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2424

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2425

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2428

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2643

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2669

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0877

Source: cve@mitre.org

Third Party Advisory

https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/bcgit/bc-java/wiki/CVE-2018-1000180

Source: cve@mitre.org

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20190204-0003/

Source: cve@mitre.org

PatchThird Party Advisory

https://www.bountysource.com/issues/58293083-rsa-key-generation-computation-of-iterations-for-mr-primality-test

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2018/dsa-4233

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: cve@mitre.org

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/106567