CVE-2022-45146
published 2022-11-21CVE-2022-45146: An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue…
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.43%
35.2th percentile
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bouncycastle | fips_java_api | < 1.0.2.4 | 1.0.2.4 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
bouncy-castle: Improper Authentication
vendor_redhat·2022-11-21·CVSS 5.5
CVE-2022-45146 [MEDIUM] CWE-416 bouncy-castle: Improper Authentication
bouncy-castle: Improper Authentication
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
A flaw was found in the FIPS Java API of Bouncy Castle BC-FJA. Affected versions of this package are vulnerable to Improper Authentication. Changes to the JVM garbage collector in Java 13 and later can trigger an issue in the BC-FJA FIPS modules, where it is possible for temporary keys used by the module t
OSV
CVE-2022-45146: An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1
osv·2022-11-21·CVSS 5.5
CVE-2022-45146 [MEDIUM] CVE-2022-45146: An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
GHSA
Garbage collection issue in BC-FJA in Java 13 and later
ghsa·2022-11-21
CVE-2022-45146 [MEDIUM] CWE-416 Garbage collection issue in BC-FJA in Java 13 and later
Garbage collection issue in BC-FJA in Java 13 and later
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss.
NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
OSV
Garbage collection issue in BC-FJA in Java 13 and later
osv·2022-11-21
CVE-2022-45146 [MEDIUM] Garbage collection issue in BC-FJA in Java 13 and later
Garbage collection issue in BC-FJA in Java 13 and later
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss.
NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
No detection rules found.
No public exploits indexed.
https://github.com/bcgit/bc-java/wiki/CVE-2022-45146https://mvnrepository.com/artifact/org.bouncycastle/bc-fipshttps://www.bouncycastle.org/latest_releases.htmlhttps://github.com/bcgit/bc-java/wiki/CVE-2022-45146https://mvnrepository.com/artifact/org.bouncycastle/bc-fipshttps://www.bouncycastle.org/latest_releases.html
2022-11-21
Published