What is the CVSS score of CVE-2018-1000180?

CVE-2018-1000180 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 3.6%.

Is there a patch available for CVE-2018-1000180?

Yes, a patch is available for CVE-2018-1000180. Update the affected software to the latest version immediately.

Bc Java CVE-2018-1000180

HIGH

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2018-06-05 cve@mitre.org

Information Disclosure Bc Java Fips Java Api Debian Linux Api Gateway Business Process Management Suite Business Transaction Management Communications Application Session Controller Communications Converged Application Server Communications Webrtc Session Controller Enterprise Repository Managed File Transfer Peoplesoft Enterprise Peopletools Retail Convenience And Fuel Pos Software Retail Xstore Point Of Service Soa Suite Webcenter Portal Weblogic Server Oncommand Workflow Automation Virtualization Jboss Enterprise Application Platform

7.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jun 05, 2018 - 13:29 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

32 maven packages depend on org.bouncycastle:bcprov-jdk14 (4 direct, 28 indirect)
6,190 maven packages depend on org.bouncycastle:bcprov-jdk15on (473 direct, 5,744 indirect)

Ecosystem-wide dependent count for version 1.60 and other introduced versions.

DescriptionNVD

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

AnalysisAI

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-327. Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later. Affected products include: Bouncycastle Bc-Java, Bouncycastle Fips Java Api, Debian Debian Linux, Oracle Api Gateway, Oracle Business Process Management Suite.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.