CVE-2022-45146

An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/bcgit/bc-java/wiki/CVE-2022-45146	Exploit Third Party Advisory
https://mvnrepository.com/artifact/org.bouncycastle/bc-fips
https://www.bouncycastle.org/latest_releases.html	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:*

cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*

History

13 Feb 2024, 19:15

Type	Values Removed	Values Added
References		() https://mvnrepository.com/artifact/org.bouncycastle/bc-fips -

30 Nov 2022, 15:14

Type	Values Removed	Values Added
References	~~(CONFIRM) https://github.com/bcgit/bc-java/wiki/CVE-2022-45146 -~~	(CONFIRM) https://github.com/bcgit/bc-java/wiki/CVE-2022-45146 - Exploit, Third Party Advisory
References	~~(MISC) https://www.bouncycastle.org/latest_releases.html -~~	(MISC) https://www.bouncycastle.org/latest_releases.html - Release Notes, Vendor Advisory
CWE		CWE-416
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CPE		cpe:2.3:a:oracle:jdk:::::::: cpe:2.3:a:bouncycastle:fips_java_api::::::::

21 Nov 2022, 13:00

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-11-21 10:15

Updated : 2024-02-13 19:15

NVD link : CVE-2022-45146

Mitre link : CVE-2022-45146

CVE.ORG link : CVE-2022-45146

JSON object : View

Products Affected

bouncycastle

fips_java_api

oracle

jdk

CWE

CWE-416

Use After Free

{"id": "CVE-2022-45146", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-11-21T10:15:31.593", "references": [{"url": "https://github.com/bcgit/bc-java/wiki/CVE-2022-45146", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://mvnrepository.com/artifact/org.bouncycastle/bc-fips", "source": "cve@mitre.org"}, {"url": "https://www.bouncycastle.org/latest_releases.html", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en la API FIPS Java de Bouncy Castle BC-FJA antes de la versi\u00f3n 1.0.2.4. Los cambios en el recolector de basura JVM en Java 13 y versiones posteriores desencadenan un problema en los m\u00f3dulos BC-FJA FIPS donde es posible que las claves temporales utilizadas por el m\u00f3dulo se pongan a cero mientras el m\u00f3dulo a\u00fan las usa, lo que genera errores o informaci\u00f3n potencial. p\u00e9rdida. NOTA: Los usuarios que cumplen con FIPS no se ven afectados porque la certificaci\u00f3n FIPS es solo para Java 7, 8 y 11."}], "lastModified": "2024-02-13T19:15:08.393", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "326EBBC5-8448-412E-9B9E-6D93A0BD4790", "versionEndExcluding": "1.0.2.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9CF0C6F0-395B-4F4A-A950-9967572FCA0F", "versionStartIncluding": "13.0.0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}