CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2018-1000180
High (7.5). EPSS 3.4% chance of exploitation in the next 30 days. Fixed in org.bouncycastle:bcprov-jdk14 1.60.
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
Severity
- EPSS
- 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-327
- Published
- Modified
- Record from
- the NVD, synced
Affected
- bouncycastle:bc-java
- bouncycastle:fips_java_api
- debian:debian_linux
- netapp:oncommand_workflow_automation
- oracle:api_gateway
- oracle:business_process_management_suite
- oracle:business_transaction_management
- oracle:communications_application_session_controller
- oracle:communications_converged_application_server
- oracle:communications_webrtc_session_controller
- oracle:enterprise_repository
- oracle:managed_file_transfer
- oracle:peoplesoft_enterprise_peopletools
- oracle:retail_convenience_and_fuel_pos_software
- oracle:retail_xstore_point_of_service
- oracle:soa_suite
- oracle:webcenter_portal
- oracle:weblogic_server
- redhat:jboss_enterprise_application_platform
- redhat:virtualization
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xqj7-j8j5-f2xr | Maven | org.bouncycastle:bcprov-jdk14 | <1.60 | 1.60 |
| GHSA-xqj7-j8j5-f2xr | Maven | org.bouncycastle:bcprov-jdk15 | <1.60 | 1.60 |
| GHSA-xqj7-j8j5-f2xr | Maven | org.bouncycastle:bcprov-jdk15on | <1.60 | 1.60 |