CVE-2018-1000180: bouncycastle bc-java
CVSS: 7.5v3.0HighModified
AliasesUBUNTU-CVE-2018-1000180DEBIAN-CVE-2018-1000180DSA-4233-1CGA-25m6-87cp-ph8wCGA-25p3-mvh9-gqwjCGA-264w-xr7c-r4j9CGA-26cp-932j-36gfCGA-29x7-45v7-qq5mCGA-2h4j-2mgh-g95hCGA-2jrv-pf87-3mh6CGA-2xmc-cvvw-pq4rCGA-338f-jhm7-8w4xCGA-37hv-7g25-xhq8CGA-3hwr-f77m-3ww3CGA-3rj2-x5ff-5p9rCGA-3xhj-pc4q-7m3qCGA-45hg-jp94-4p4vCGA-4775-q8w6-p2mvCGA-4g58-vq62-4cq7CGA-4gp4-mpwf-59whCGA-4m56-m2wj-jg7rCGA-4vcj-h888-hw8xCGA-4vfj-7cg6-mpcgCGA-4vm5-mf8q-3cffCGA-4x79-f6cx-2qpcCGA-5ff9-cm96-rjf8CGA-5g42-7576-pwhqCGA-5qfr-m7g8-mchmCGA-5vj6-3vgw-x7cfCGA-5xj2-qr7q-4jm3CGA-634j-9prx-wg36CGA-652r-mf6g-3mxcCGA-65c5-rvw2-r468CGA-67h9-xx85-mh64CGA-67hr-9gmq-qjh6CGA-683g-4j99-9h97CGA-6g2c-82p6-cpc4CGA-6g83-m335-fx97CGA-6jx2-gc67-387jCGA-6xwc-gxm6-qmjvCGA-72h2-qhqx-6p77CGA-72rr-9938-g87pCGA-74x6-g3qc-4fh3CGA-77mh-4g2x-935vCGA-8863-w727-9gpcCGA-898h-g334-g7h9CGA-8fq2-f84m-4j8gCGA-8g8p-gfwx-w9pqCGA-8jc8-xw2p-w335CGA-8q3g-pc5m-wmhgCGA-93r7-g5w4-c7h9CGA-9f9p-p239-fjr2CGA-9j24-9ffr-h9qxCGA-9pp6-p96m-8x7fCGA-c5cj-789c-wjxjCGA-c85x-q2wf-623xCGA-c8c7-8vhq-7qhrCGA-cgw8-wr2x-3x43CGA-f4g9-hr8m-q9cfCGA-f556-3v4f-65jrCGA-fc34-887r-wj8wCGA-g37x-xvwh-8j2cCGA-g3vw-3j8w-j4jpCGA-gxfw-3f84-92w3CGA-h2r8-pjxx-whm2CGA-hcpw-2q39-rxjjCGA-hggv-p593-4q33CGA-hhw4-ff9j-3vg4CGA-hq3x-jxqf-hx86CGA-j5mr-vmqc-pjpwCGA-jf3w-vrh9-x9g3CGA-jrqp-j69w-6cg3CGA-m74m-8cvr-9p38CGA-m7qj-cc3v-qhvgCGA-mcrq-8mj3-6hfgCGA-mgpc-fp8c-m96hCGA-mmw5-v52x-58ghCGA-mppc-vmhv-g745CGA-mr56-6g2g-77mqCGA-p2fq-574x-q3x3CGA-p2m7-qvq7-jg5gCGA-p2vc-88cw-vx2pCGA-p4q7-q35h-pj84CGA-phv9-m7mr-q938CGA-pj22-mf9m-jpqcGHSA-xqj7-j8j5-f2xrCGA-q45g-x4g2-jx7gCGA-q482-cc8m-p6gxCGA-q6vr-vxqc-vp5vCGA-q9xh-5qj7-x3f6CGA-qg67-9x2v-q53fCGA-qvmc-w5x8-hrqcCGA-qvqx-jxp7-83xvCGA-r5wq-rc67-43rfCGA-r6wx-r648-m257CGA-r6xp-4p8v-2cv4CGA-v2h2-298m-hfm6CGA-v574-fjc3-23jhCGA-v6mr-v8gm-mwf7CGA-vjmw-j6r8-3vvfCGA-vjp8-xg87-672gCGA-vr9m-jjcv-w836CGA-vx23-3xgx-277hCGA-vx74-3m82-gh52CGA-w7q3-38r7-j6wxCGA-wq5w-7774-68j6CGA-wvm3-fgvc-hqp9CGA-x2hm-rf7q-33vvCGA-x48h-746p-6g6gCGA-x723-2c4f-m6m8CGA-x827-pfxq-63gfCGA-xq2q-pmq9-9564
Published 05-06-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-1000180 is a high (CVSS 7.5) vulnerability in bouncycastle bc-java. EPSS estimates a 3.42% chance of exploitation in the next 30 days, higher than 88.7% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.0 (NVD)EPSS score
3.42%
0%100%
Low · -0.16 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 1Timeline
- 05-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
3.42%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
-0.16 pp
From 3.58% on 18-09-2026
18-09-202618-10-2026
EPSS score3.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard51 products
- eco-java-gradle-1.11All versions (No fix recorded)
- eco-java-gradle-2.0All versions (No fix recorded)
- eco-java-gradle-2.1All versions (No fix recorded)
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
Oracle14 products
- api_gateway11.1.2.4.0
- business_process_management_suite11.1.1.9.0 | 12.1.3.0.0 | 12.2.1.3.0
- business_transaction_management12.1.0
- communications_application_session_controller3.7.1 | 3.8.0
- communications_converged_application_server< 7.0.0.1
Org.bouncycastle3 products
- bcprov-jdk14< 1.60
- bcprov-jdk15< 1.60
- bcprov-jdk15on< 1.60
Bouncycastle2 products
- bc-java≥ 1.54, ≤ 1.59
- fips_java_api≤ 1.0.1
Debian2 products
- bouncycastle< 1.59-2 | < 1.56-1+deb9u2
- debian_linuxEOL9.0
Redhat2 products
Netapp1 product
Ubuntu1 product
- bouncycastleAll versions (No fix recorded)
8 vendors · 76 products
References
29 links- access.redhat.com/errata/RHSA-2018:2428Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2669Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2643Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2424Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2423Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2018:2425Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
www.debian.org/security/2018/dsa-4233Vendor AdvisoryX Refsource DEBIANThird Party AdvisoryAdvisoryWEB- access.redhat.com/errata/RHSA-2019:0877Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
Show all 29 references
- www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlX Refsource CONFIRMPatchThird Party AdvisoryFIXWEB
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party AdvisoryFIXWEB
- github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55adX Refsource CONFIRMPatchThird Party AdvisoryFIXWEB
- github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839X Refsource CONFIRMPatchThird Party AdvisoryFIXWEB
