cve-2022-45146
Vulnerability from cvelistv5
Published
2022-11-21 00:00
Modified
2024-08-03 14:09
Severity ?
Summary
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
References
cve@mitre.orghttps://github.com/bcgit/bc-java/wiki/CVE-2022-45146Exploit, Third Party Advisory
cve@mitre.orghttps://mvnrepository.com/artifact/org.bouncycastle/bc-fips
cve@mitre.orghttps://www.bouncycastle.org/latest_releases.htmlRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/bcgit/bc-java/wiki/CVE-2022-45146Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://mvnrepository.com/artifact/org.bouncycastle/bc-fips
af854a3a-2127-422b-91ae-364da2661108https://www.bouncycastle.org/latest_releases.htmlRelease Notes, Vendor Advisory
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:09:56.019Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.bouncycastle.org/latest_releases.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/bcgit/bc-java/wiki/CVE-2022-45146"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://mvnrepository.com/artifact/org.bouncycastle/bc-fips"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T18:10:07.400848",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.bouncycastle.org/latest_releases.html"
        },
        {
          "url": "https://github.com/bcgit/bc-java/wiki/CVE-2022-45146"
        },
        {
          "url": "https://mvnrepository.com/artifact/org.bouncycastle/bc-fips"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-45146",
    "datePublished": "2022-11-21T00:00:00",
    "dateReserved": "2022-11-11T00:00:00",
    "dateUpdated": "2024-08-03T14:09:56.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.0.2.4\", \"matchCriteriaId\": \"326EBBC5-8448-412E-9B9E-6D93A0BD4790\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.0.0\", \"matchCriteriaId\": \"9CF0C6F0-395B-4F4A-A950-9967572FCA0F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.\"}, {\"lang\": \"es\", \"value\": \"Se descubri\\u00f3 un problema en la API FIPS Java de Bouncy Castle BC-FJA antes de la versi\\u00f3n 1.0.2.4. Los cambios en el recolector de basura JVM en Java 13 y versiones posteriores desencadenan un problema en los m\\u00f3dulos BC-FJA FIPS donde es posible que las claves temporales utilizadas por el m\\u00f3dulo se pongan a cero mientras el m\\u00f3dulo a\\u00fan las usa, lo que genera errores o informaci\\u00f3n potencial. p\\u00e9rdida. NOTA: Los usuarios que cumplen con FIPS no se ven afectados porque la certificaci\\u00f3n FIPS es solo para Java 7, 8 y 11.\"}]",
      "id": "CVE-2022-45146",
      "lastModified": "2024-11-21T07:28:50.913",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2022-11-21T10:15:31.593",
      "references": "[{\"url\": \"https://github.com/bcgit/bc-java/wiki/CVE-2022-45146\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://mvnrepository.com/artifact/org.bouncycastle/bc-fips\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://www.bouncycastle.org/latest_releases.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/bcgit/bc-java/wiki/CVE-2022-45146\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://mvnrepository.com/artifact/org.bouncycastle/bc-fips\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.bouncycastle.org/latest_releases.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-45146\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-11-21T10:15:31.593\",\"lastModified\":\"2024-11-21T07:28:50.913\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.\"},{\"lang\":\"es\",\"value\":\"Se descubri\u00f3 un problema en la API FIPS Java de Bouncy Castle BC-FJA antes de la versi\u00f3n 1.0.2.4. Los cambios en el recolector de basura JVM en Java 13 y versiones posteriores desencadenan un problema en los m\u00f3dulos BC-FJA FIPS donde es posible que las claves temporales utilizadas por el m\u00f3dulo se pongan a cero mientras el m\u00f3dulo a\u00fan las usa, lo que genera errores o informaci\u00f3n potencial. p\u00e9rdida. NOTA: Los usuarios que cumplen con FIPS no se ven afectados porque la certificaci\u00f3n FIPS es solo para Java 7, 8 y 11.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.0.2.4\",\"matchCriteriaId\":\"326EBBC5-8448-412E-9B9E-6D93A0BD4790\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.0.0\",\"matchCriteriaId\":\"9CF0C6F0-395B-4F4A-A950-9967572FCA0F\"}]}]}],\"references\":[{\"url\":\"https://github.com/bcgit/bc-java/wiki/CVE-2022-45146\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://mvnrepository.com/artifact/org.bouncycastle/bc-fips\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.bouncycastle.org/latest_releases.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/bcgit/bc-java/wiki/CVE-2022-45146\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://mvnrepository.com/artifact/org.bouncycastle/bc-fips\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.bouncycastle.org/latest_releases.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.