var-201806-0859
Vulnerability from variot
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later. Bouncy Castle BC and BC-FJA Contains a cryptographic vulnerability.Information may be obtained. Bouncy Castle is prone to a security weakness. Successfully exploiting this issue will allow attackers to perform unauthorized actions; this may aid in launching further attacks. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements.
The References section of this erratum contains a download link (you must log in to download the update).
The JBoss server process must be restarted for the update to take effect. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Important: rhvm-appliance security update Advisory ID: RHSA-2018:2643-01 Product: Red Hat Virtualization Advisory URL: https://access.redhat.com/errata/RHSA-2018:2643 Issue date: 2018-08-15 Updated on: 2018-09-04 CVE Names: CVE-2018-1067 CVE-2018-1114 CVE-2018-8039 CVE-2018-10237 CVE-2018-10862 CVE-2018-10915 CVE-2018-1000180 =====================================================================
- Summary:
An update for rhvm-appliance is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Virtualization 4 Hypervisor for RHEL 7 - noarch Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts - noarch
- Description:
The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal.
The following packages have been upgraded to a later upstream version: rhvm-appliance (4.2). (BZ#1590658, BZ#1591095, BZ#1591096, BZ#1592655, BZ#1594636, BZ#1597534, BZ#1612683)
Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915 and Ammarit Thongthua (Deloitte Thailand Pentest team) and Nattakit Intarasorn (Deloitte Thailand Pentest team) for reporting CVE-2018-1067. Upstream acknowledges Andrew Krasichkov as the original reporter of CVE-2018-10915.
Security fixes:
-
vulnerability: wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip) (CVE-2018-10862)
-
vulnerability: apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)
-
vulnerability: postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)
-
vulnerability: undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of ) (CVE-2018-1067, CVE-2016-4993)
-
vulnerability: undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service (CVE-2018-1114)
-
vulnerability: guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service (CVE-2018-10237)
-
vulnerability: bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180)
For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/2974891
- Bugs fixed (https://bugzilla.redhat.com/):
1550671 - CVE-2018-1067 undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993) 1573045 - CVE-2018-1114 undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service 1573391 - CVE-2018-10237 guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service 1588306 - CVE-2018-1000180 bouncycastle: flaw in the low-level interface to RSA key pair generator 1593527 - CVE-2018-10862 wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip) 1595332 - CVE-2018-8039 apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* 1609891 - CVE-2018-10915 postgresql: Certain host connection parameters defeat client-side security defenses 1616249 - [Tracker] rhevm-appliance build for 4.2.6
- Package List:
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts:
Source: rhvm-appliance-4.2-20180828.0.el7.src.rpm
noarch: rhvm-appliance-4.2-20180828.0.el7.noarch.rpm
Red Hat Virtualization 4 Hypervisor for RHEL 7:
Source: rhvm-appliance-4.2-20180828.0.el7.src.rpm
noarch: rhvm-appliance-4.2-20180828.0.el7.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2018-1067 https://access.redhat.com/security/cve/CVE-2018-1114 https://access.redhat.com/security/cve/CVE-2018-8039 https://access.redhat.com/security/cve/CVE-2018-10237 https://access.redhat.com/security/cve/CVE-2018-10862 https://access.redhat.com/security/cve/CVE-2018-10915 https://access.redhat.com/security/cve/CVE-2018-1000180 https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBW46NB9zjgjWX9erEAQio7g/9G8C/6hJR+vGBA0J+d4fLqffWMPAlUQIo S5exHdBllncWKMutR/6oADOC0w/arYrQE7MLjxlZAvYZUS2A6NgmjsVh38BgFpBt ijYkgIOXef9dfsk2e04+r1tDr8iSsk7PSw4RYUFZwm8f7jhT4+72RepQfnnXMhLF tBUqTdzkXyZYNjfssqyz1d+2ZMjx7MigUvL9qFoRT5KCdeNwpVnvpqOAx6t0CVHy TY86IqBsYJ59W4+S+GNdob3SYEt9i2kyN3ggurhOjjk+0aNR+520WRV/aMCBpd6e kyHPvZtT2sQElgUuHmf0Pv9tJ7MOf0ybQtdTX0XIiQxxo1e1SGpUAd+2LXbuthY9 fgAZzel6SZ4hkOzQMVWnwl43FRQTKzXLKV9N5qXma7ilkJPjyUUe5uFBB7eSNI7x L9949I807LHRCSBzuwK6SM7MZHgSjPo0bEfyU2jmJXBNP9wbjGjq1jBugIF3kFVR WAMUbmGEZUP6GLej+xuYeesjglTbA38/EmyW1btkbIlc22PO7byQwNIPPDwyzctT +nVvwMr5E5k4ael3epg46Ddf96ZJ6D8jjFKhveWoNdW5ZkDaiSjiMbJrGCModdX4 /KxDAb22DwAG6cy3wuCJuPHG95LRhKWVc77WdySHBiWkOplgDsELaTGTNNu69Ch9 WehWD0T5PlI= =Ki4n -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . For further information, refer to the release notes linked to in the References section.
For the stable distribution (stretch), this problem has been fixed in version 1.56-1+deb9u2.
We recommend that you upgrade your bouncycastle packages.
For the detailed security status of bouncycastle please refer to its security tracker page at: https://security-tracker.debian.org/tracker/bouncycastle
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlstVJsACgkQEMKTtsN8 TjbYZw/+Ig5wYiaMaeNbnzRu8Je7e4jGvglWlqLeTX7xG2hpzaFHCeOFxTX9oJmt r/8y/wZMhf+pV3h1KlP9nxOLEhchcL4hSAM4necgVP6odykbH0Em2yAE5i7ae9ez oD9Ib7dUUFbRk2a19J4bVdXXUjb3YQCN1SsS5KVYfWDgzxa+dC34vhm3yfNqoPej 0sFczW7kuUUK61a9LwNmuTp8hVyvtNc5FjhK5mEB3Fi2EiYYn8UT/LNp5QElKB4i h7P6c1Q9jw8VSqvRqlt4n2+HAreKmOS8a61hFYFV/HFoer6rOxa03YDcC0rlva7O a0WcOzet/IzRCOJilj2TIgXBZzFb3peyzd4arTa/VCt794qHOTIElBnmvAvVeXBW yu83IQrDYrKnwm85K0R3YUXaBzaGTeVPwnYPJnYRydlF/zxvg7l9xx7Cy7PJN2Xh Y+visDrPob09QFNc4PYlzQ+V6vrFrygAPO7CJ7hY7KrF8nuhbt9Ygd75IBIMTqhZ QsQlAUZ8UU7q9vVPZCZFb89ks5WyRm8O7Kdn5wzEx1Egas1/jfUzfMOUYTEl0nfM iOk0Q0pFpbwQ+9vWZBMWYTVHXUi8jabBbJcM4g9xVzlDk2mqTVaimnFXfl28Y3aK D8ul9kVTrOOX/jutkY46hdLOhmGo52oHDW5qiJtQL49QzC+Qm3o= =p+RC -----END PGP SIGNATURE----- . Description:
Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.
This release of Red Hat JBoss Enterprise Application Platform 7.1.4 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. JIRA issues fixed (https://issues.jboss.org/):
JBEAP-14788 - Tracker bug for the EAP 7.1.4 release for RHEL-7
7
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201806-0859",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linux",
"scope": "eq",
"trust": 1.6,
"vendor": "debian",
"version": "9.0"
},
{
"model": "webcenter portal",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "12.2.1.3.0"
},
{
"model": "webcenter portal",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "11.1.1.9.0"
},
{
"model": "soa suite",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "12.2.1.3.0"
},
{
"model": "soa suite",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "12.1.3.0.0"
},
{
"model": "retail xstore point of service",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "7.1"
},
{
"model": "retail xstore point of service",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "7.0"
},
{
"model": "retail convenience and fuel pos software",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "2.8.1"
},
{
"model": "peoplesoft enterprise peopletools",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "8.57"
},
{
"model": "peoplesoft enterprise peopletools",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "8.56"
},
{
"model": "peoplesoft enterprise peopletools",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "8.55"
},
{
"model": "managed file transfer",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "12.2.1.3.0"
},
{
"model": "managed file transfer",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "12.1.3.0.0"
},
{
"model": "enterprise repository",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "12.1.3.0.0"
},
{
"model": "communications application session controller",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "3.7.1"
},
{
"model": "business transaction management",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "12.1.0"
},
{
"model": "business process management suite",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "12.2.1.3.0"
},
{
"model": "business process management suite",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "12.1.3.0.0"
},
{
"model": "business process management suite",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "11.1.1.9.0"
},
{
"model": "api gateway",
"scope": "eq",
"trust": 1.3,
"vendor": "oracle",
"version": "11.1.2.4.0"
},
{
"model": "fips java api",
"scope": "lte",
"trust": 1.0,
"vendor": "bouncycastle",
"version": "1.0.1"
},
{
"model": "jboss enterprise application platform",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.1.0"
},
{
"model": "legion-of-the-bouncy-castle-java-crytography-api",
"scope": "lte",
"trust": 1.0,
"vendor": "bouncycastle",
"version": "1.59"
},
{
"model": "legion-of-the-bouncy-castle-java-crytography-api",
"scope": "gte",
"trust": 1.0,
"vendor": "bouncycastle",
"version": "1.54"
},
{
"model": "virtualization",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "4.2"
},
{
"model": "communications application session controller",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "3.8.0"
},
{
"model": "weblogic server",
"scope": "eq",
"trust": 1.0,
"vendor": "oracle",
"version": "12.1.3.0.0"
},
{
"model": "communications converged application server",
"scope": "lt",
"trust": 1.0,
"vendor": "oracle",
"version": "7.0.0.1"
},
{
"model": "communications webrtc session controller",
"scope": "lt",
"trust": 1.0,
"vendor": "oracle",
"version": "7.2"
},
{
"model": "oncommand workflow automation",
"scope": "eq",
"trust": 1.0,
"vendor": "netapp",
"version": null
},
{
"model": "java cryptography api",
"scope": null,
"trust": 0.8,
"vendor": "bouncy castle",
"version": null
},
{
"model": "fips java api",
"scope": null,
"trust": 0.8,
"vendor": "bouncy castle",
"version": null
},
{
"model": "gnu/linux",
"scope": null,
"trust": 0.8,
"vendor": "debian",
"version": null
},
{
"model": "virtualization",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "software collections for rhel",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "0"
},
{
"model": "satellite",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "openshift application runtimes",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "1.0"
},
{
"model": "jboss fuse",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6.0"
},
{
"model": "weblogic server",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "12.2.1.3"
},
{
"model": "enterprise manager for fusion middleware",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "13.3"
},
{
"model": "enterprise manager for fusion middleware",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "13.2"
},
{
"model": "data integrator",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "12.2.1.3.0"
},
{
"model": "communications webrtc session controller",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "7.1"
},
{
"model": "communications webrtc session controller",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "7.0"
},
{
"model": "communications convergence",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "3.0.2"
},
{
"model": "communications converged application server",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "7.0"
},
{
"model": "communications application session controller",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "3.8"
},
{
"model": "fips java api",
"scope": "eq",
"trust": 0.3,
"vendor": "bouncycastle",
"version": "1.0.1"
},
{
"model": "fips java api",
"scope": "eq",
"trust": 0.3,
"vendor": "bouncycastle",
"version": "1.0"
},
{
"model": "bouncy castle",
"scope": "eq",
"trust": 0.3,
"vendor": "bouncycastle",
"version": "1.59"
},
{
"model": "bouncy castle",
"scope": "eq",
"trust": 0.3,
"vendor": "bouncycastle",
"version": "1.54"
},
{
"model": "communications webrtc session controller",
"scope": "ne",
"trust": 0.3,
"vendor": "oracle",
"version": "7.2"
},
{
"model": "communications converged application server",
"scope": "ne",
"trust": 0.3,
"vendor": "oracle",
"version": "7.0.0.1"
},
{
"model": "fips java api",
"scope": "ne",
"trust": 0.3,
"vendor": "bouncycastle",
"version": "1.0.2"
},
{
"model": "bouncy castle beta4",
"scope": "ne",
"trust": 0.3,
"vendor": "bouncycastle",
"version": "1.60"
}
],
"sources": [
{
"db": "BID",
"id": "106567"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006359"
},
{
"db": "CNNVD",
"id": "CNNVD-201806-332"
},
{
"db": "NVD",
"id": "CVE-2018-1000180"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:bouncycastle:fips_java_api",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:debian:debian_linux",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-006359"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "149311"
},
{
"db": "PACKETSTORM",
"id": "148942"
},
{
"db": "PACKETSTORM",
"id": "149229"
},
{
"db": "PACKETSTORM",
"id": "152620"
},
{
"db": "PACKETSTORM",
"id": "148944"
},
{
"db": "PACKETSTORM",
"id": "148945"
}
],
"trust": 0.6
},
"cve": "CVE-2018-1000180",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2018-1000180",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-119384",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2018-1000180",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-1000180",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-1000180",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201806-332",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-119384",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2018-1000180",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-119384"
},
{
"db": "VULMON",
"id": "CVE-2018-1000180"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006359"
},
{
"db": "CNNVD",
"id": "CNNVD-201806-332"
},
{
"db": "NVD",
"id": "CVE-2018-1000180"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later. Bouncy Castle BC and BC-FJA Contains a cryptographic vulnerability.Information may be obtained. Bouncy Castle is prone to a security weakness. \nSuccessfully exploiting this issue will allow attackers to perform unauthorized actions; this may aid in launching further attacks. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. \n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). \n\nThe JBoss server process must be restarted for the update to take effect. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Important: rhvm-appliance security update\nAdvisory ID: RHSA-2018:2643-01\nProduct: Red Hat Virtualization\nAdvisory URL: https://access.redhat.com/errata/RHSA-2018:2643\nIssue date: 2018-08-15\nUpdated on: 2018-09-04\nCVE Names: CVE-2018-1067 CVE-2018-1114 CVE-2018-8039 \n CVE-2018-10237 CVE-2018-10862 CVE-2018-10915 \n CVE-2018-1000180 \n=====================================================================\n\n1. Summary:\n\nAn update for rhvm-appliance is now available for Red Hat Virtualization 4\nfor Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Virtualization 4 Hypervisor for RHEL 7 - noarch\nRed Hat Virtualization 4 Management Agent for RHEL 7 Hosts - noarch\n\n3. Description:\n\nThe RHV-M Virtual Appliance automates the process of installing and\nconfiguring the Red Hat Virtualization Manager. The appliance is available\nto download as an OVA file from the Customer Portal. \n\nThe following packages have been upgraded to a later upstream version:\nrhvm-appliance (4.2). (BZ#1590658, BZ#1591095, BZ#1591096, BZ#1592655,\nBZ#1594636, BZ#1597534, BZ#1612683)\n\nRed Hat would like to thank the PostgreSQL project for reporting\nCVE-2018-10915 and Ammarit Thongthua (Deloitte Thailand Pentest team) and\nNattakit Intarasorn (Deloitte Thailand Pentest team) for reporting\nCVE-2018-1067. Upstream acknowledges Andrew Krasichkov as the original\nreporter of CVE-2018-10915. \n\nSecurity fixes:\n\n* vulnerability: wildfly-core: Path traversal can allow the extraction of\n.war archives to write arbitrary files (Zip Slip) (CVE-2018-10862)\n\n* vulnerability: apache-cxf: TLS hostname verification does not work\ncorrectly with com.sun.net.ssl.* (CVE-2018-8039)\n\n* vulnerability: postgresql: Certain host connection parameters defeat\nclient-side security defenses (CVE-2018-10915)\n\n* vulnerability: undertow: HTTP header injection using CRLF with UTF-8\nEncoding (incomplete fix of ) (CVE-2018-1067, CVE-2016-4993)\n\n* vulnerability: undertow: File descriptor leak caused by\nJarURLConnection.getLastModified() allows attacker to cause a denial of\nservice (CVE-2018-1114)\n\n* vulnerability: guava: Unbounded memory allocation in AtomicDoubleArray\nand CompoundOrdering classes allow remote attackers to cause a denial of\nservice (CVE-2018-10237)\n\n* vulnerability: bouncycastle: flaw in the low-level interface to RSA key\npair generator (CVE-2018-1000180)\n\nFor more details about the security issues, including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npages listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1550671 - CVE-2018-1067 undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)\n1573045 - CVE-2018-1114 undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service\n1573391 - CVE-2018-10237 guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service\n1588306 - CVE-2018-1000180 bouncycastle: flaw in the low-level interface to RSA key pair generator\n1593527 - CVE-2018-10862 wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)\n1595332 - CVE-2018-8039 apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*\n1609891 - CVE-2018-10915 postgresql: Certain host connection parameters defeat client-side security defenses\n1616249 - [Tracker] rhevm-appliance build for 4.2.6\n\n6. Package List:\n\nRed Hat Virtualization 4 Management Agent for RHEL 7 Hosts:\n\nSource:\nrhvm-appliance-4.2-20180828.0.el7.src.rpm\n\nnoarch:\nrhvm-appliance-4.2-20180828.0.el7.noarch.rpm\n\nRed Hat Virtualization 4 Hypervisor for RHEL 7:\n\nSource:\nrhvm-appliance-4.2-20180828.0.el7.src.rpm\n\nnoarch:\nrhvm-appliance-4.2-20180828.0.el7.noarch.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-1067\nhttps://access.redhat.com/security/cve/CVE-2018-1114\nhttps://access.redhat.com/security/cve/CVE-2018-8039\nhttps://access.redhat.com/security/cve/CVE-2018-10237\nhttps://access.redhat.com/security/cve/CVE-2018-10862\nhttps://access.redhat.com/security/cve/CVE-2018-10915\nhttps://access.redhat.com/security/cve/CVE-2018-1000180\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBW46NB9zjgjWX9erEAQio7g/9G8C/6hJR+vGBA0J+d4fLqffWMPAlUQIo\nS5exHdBllncWKMutR/6oADOC0w/arYrQE7MLjxlZAvYZUS2A6NgmjsVh38BgFpBt\nijYkgIOXef9dfsk2e04+r1tDr8iSsk7PSw4RYUFZwm8f7jhT4+72RepQfnnXMhLF\ntBUqTdzkXyZYNjfssqyz1d+2ZMjx7MigUvL9qFoRT5KCdeNwpVnvpqOAx6t0CVHy\nTY86IqBsYJ59W4+S+GNdob3SYEt9i2kyN3ggurhOjjk+0aNR+520WRV/aMCBpd6e\nkyHPvZtT2sQElgUuHmf0Pv9tJ7MOf0ybQtdTX0XIiQxxo1e1SGpUAd+2LXbuthY9\nfgAZzel6SZ4hkOzQMVWnwl43FRQTKzXLKV9N5qXma7ilkJPjyUUe5uFBB7eSNI7x\nL9949I807LHRCSBzuwK6SM7MZHgSjPo0bEfyU2jmJXBNP9wbjGjq1jBugIF3kFVR\nWAMUbmGEZUP6GLej+xuYeesjglTbA38/EmyW1btkbIlc22PO7byQwNIPPDwyzctT\n+nVvwMr5E5k4ael3epg46Ddf96ZJ6D8jjFKhveWoNdW5ZkDaiSjiMbJrGCModdX4\n/KxDAb22DwAG6cy3wuCJuPHG95LRhKWVc77WdySHBiWkOplgDsELaTGTNNu69Ch9\nWehWD0T5PlI=\n=Ki4n\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. For\nfurther information, refer to the release notes linked to in the References\nsection. \n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 1.56-1+deb9u2. \n\nWe recommend that you upgrade your bouncycastle packages. \n\nFor the detailed security status of bouncycastle please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/bouncycastle\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlstVJsACgkQEMKTtsN8\nTjbYZw/+Ig5wYiaMaeNbnzRu8Je7e4jGvglWlqLeTX7xG2hpzaFHCeOFxTX9oJmt\nr/8y/wZMhf+pV3h1KlP9nxOLEhchcL4hSAM4necgVP6odykbH0Em2yAE5i7ae9ez\noD9Ib7dUUFbRk2a19J4bVdXXUjb3YQCN1SsS5KVYfWDgzxa+dC34vhm3yfNqoPej\n0sFczW7kuUUK61a9LwNmuTp8hVyvtNc5FjhK5mEB3Fi2EiYYn8UT/LNp5QElKB4i\nh7P6c1Q9jw8VSqvRqlt4n2+HAreKmOS8a61hFYFV/HFoer6rOxa03YDcC0rlva7O\na0WcOzet/IzRCOJilj2TIgXBZzFb3peyzd4arTa/VCt794qHOTIElBnmvAvVeXBW\nyu83IQrDYrKnwm85K0R3YUXaBzaGTeVPwnYPJnYRydlF/zxvg7l9xx7Cy7PJN2Xh\nY+visDrPob09QFNc4PYlzQ+V6vrFrygAPO7CJ7hY7KrF8nuhbt9Ygd75IBIMTqhZ\nQsQlAUZ8UU7q9vVPZCZFb89ks5WyRm8O7Kdn5wzEx1Egas1/jfUzfMOUYTEl0nfM\niOk0Q0pFpbwQ+9vWZBMWYTVHXUi8jabBbJcM4g9xVzlDk2mqTVaimnFXfl28Y3aK\nD8ul9kVTrOOX/jutkY46hdLOhmGo52oHDW5qiJtQL49QzC+Qm3o=\n=p+RC\n-----END PGP SIGNATURE-----\n. Description:\n\nRed Hat JBoss Enterprise Application Platform is a platform for Java\napplications based on the JBoss Application Server. \n\nThis release of Red Hat JBoss Enterprise Application Platform 7.1.4 serves\nas a replacement for Red Hat JBoss Enterprise Application Platform 7.1.3,\nand includes bug fixes and enhancements, which are documented in the\nRelease Notes document linked to in the References. JIRA issues fixed (https://issues.jboss.org/):\n\nJBEAP-14788 - Tracker bug for the EAP 7.1.4 release for RHEL-7\n\n7",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-1000180"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006359"
},
{
"db": "BID",
"id": "106567"
},
{
"db": "VULHUB",
"id": "VHN-119384"
},
{
"db": "VULMON",
"id": "CVE-2018-1000180"
},
{
"db": "PACKETSTORM",
"id": "149311"
},
{
"db": "PACKETSTORM",
"id": "148942"
},
{
"db": "PACKETSTORM",
"id": "149229"
},
{
"db": "PACKETSTORM",
"id": "152620"
},
{
"db": "PACKETSTORM",
"id": "148288"
},
{
"db": "PACKETSTORM",
"id": "148944"
},
{
"db": "PACKETSTORM",
"id": "148945"
}
],
"trust": 2.7
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-119384",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-119384"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-1000180",
"trust": 3.6
},
{
"db": "BID",
"id": "106567",
"trust": 2.1
},
{
"db": "PACKETSTORM",
"id": "152620",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006359",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201806-332",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2019.1406",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.2340",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.2561",
"trust": 0.6
},
{
"db": "JUNIPER",
"id": "JSA10939",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021042531",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "149229",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "148288",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-119384",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-1000180",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "149311",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "148942",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "148944",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "148945",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-119384"
},
{
"db": "VULMON",
"id": "CVE-2018-1000180"
},
{
"db": "BID",
"id": "106567"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006359"
},
{
"db": "PACKETSTORM",
"id": "149311"
},
{
"db": "PACKETSTORM",
"id": "148942"
},
{
"db": "PACKETSTORM",
"id": "149229"
},
{
"db": "PACKETSTORM",
"id": "152620"
},
{
"db": "PACKETSTORM",
"id": "148288"
},
{
"db": "PACKETSTORM",
"id": "148944"
},
{
"db": "PACKETSTORM",
"id": "148945"
},
{
"db": "CNNVD",
"id": "CNNVD-201806-332"
},
{
"db": "NVD",
"id": "CVE-2018-1000180"
}
]
},
"id": "VAR-201806-0859",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-119384"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-29T22:04:36.616000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "DSA-4233",
"trust": 0.8,
"url": "https://www.debian.org/security/2018/dsa-4233"
},
{
"title": "BJA-694 cleaned up primality test",
"trust": 0.8,
"url": "https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839"
},
{
"title": "BJA-694 minor tweak to avoid method signature change",
"trust": 0.8,
"url": "https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad"
},
{
"title": "Bouncy Castle BC Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=80686"
},
{
"title": "Debian Security Advisories: DSA-4233-1 bouncycastle -- security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=4a57543e4dda2487f4c1ae8952d2b437"
},
{
"title": "Debian CVElist Bug Report Logs: bouncycastle: CVE-2018-1000180",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=b99c874ecc8e69545f2285d1e06207f1"
},
{
"title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182424 - Security Advisory"
},
{
"title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182423 - Security Advisory"
},
{
"title": "Red Hat: Important: Red Hat JBoss Enterprise Application Platform 7.1 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182425 - Security Advisory"
},
{
"title": "Red Hat: Important: Red Hat Single Sign-On 7.2.4 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182428 - Security Advisory"
},
{
"title": "Red Hat: Important: rhvm-appliance security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182643 - Security Advisory"
},
{
"title": "Red Hat: Important: Red Hat OpenShift Application Runtimes Thorntail 2.4.0 security \u0026 bug fix update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20190877 - Security Advisory"
},
{
"title": "Red Hat: Important: Fuse 7.1 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182669 - Security Advisory"
},
{
"title": "IBM: Security Bulletin: IBM Sterling File Gateway is vulnerable to multiple issues due to Bouncy Castle",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=3de0cda7adc2cd8a893e5cb9d7cdbe60"
},
{
"title": "Oracle: Oracle Critical Patch Update Advisory - January 2019",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=f655264a6935505d167bbf45f409a57b"
},
{
"title": "CyberSource Simple Order API for Java",
"trust": 0.1,
"url": "https://github.com/CyberSource/cybersource-sdk-java "
},
{
"title": "PHunter",
"trust": 0.1,
"url": "https://github.com/CGCL-codes/PHunter "
},
{
"title": "PHunter",
"trust": 0.1,
"url": "https://github.com/Anonymous-Phunter/PHunter "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2018-1000180"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006359"
},
{
"db": "CNNVD",
"id": "CNNVD-201806-332"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-327",
"trust": 1.1
},
{
"problemtype": "CWE-310",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-119384"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006359"
},
{
"db": "NVD",
"id": "CVE-2018-1000180"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://www.securityfocus.com/bid/106567"
},
{
"trust": 2.5,
"url": "https://access.redhat.com/errata/rhsa-2019:0877"
},
{
"trust": 2.4,
"url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
},
{
"trust": 2.1,
"url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
},
{
"trust": 2.1,
"url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
},
{
"trust": 2.1,
"url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
},
{
"trust": 1.9,
"url": "https://access.redhat.com/errata/rhsa-2018:2423"
},
{
"trust": 1.9,
"url": "https://access.redhat.com/errata/rhsa-2018:2424"
},
{
"trust": 1.9,
"url": "https://access.redhat.com/errata/rhsa-2018:2425"
},
{
"trust": 1.9,
"url": "https://access.redhat.com/errata/rhsa-2018:2643"
},
{
"trust": 1.9,
"url": "https://access.redhat.com/errata/rhsa-2018:2669"
},
{
"trust": 1.8,
"url": "https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad"
},
{
"trust": 1.8,
"url": "https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839"
},
{
"trust": 1.8,
"url": "https://security.netapp.com/advisory/ntap-20190204-0003/"
},
{
"trust": 1.8,
"url": "https://www.debian.org/security/2018/dsa-4233"
},
{
"trust": 1.8,
"url": "https://github.com/bcgit/bc-java/wiki/cve-2018-1000180"
},
{
"trust": 1.8,
"url": "https://www.bountysource.com/issues/58293083-rsa-key-generation-computation-of-iterations-for-mr-primality-test"
},
{
"trust": 1.8,
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"trust": 1.8,
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"trust": 1.8,
"url": "https://access.redhat.com/errata/rhsa-2018:2428"
},
{
"trust": 1.7,
"url": "https://www.bouncycastle.org/jira/browse/bja-694"
},
{
"trust": 1.5,
"url": "https://access.redhat.com/security/cve/cve-2018-1000180"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000180"
},
{
"trust": 1.1,
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3csolr-user.lucene.apache.org%3e"
},
{
"trust": 0.9,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1588306"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1000180"
},
{
"trust": 0.7,
"url": "https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3csolr-user.lucene.apache.org%3e"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.6,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.6,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.6,
"url": "http://kb.juniper.net/infocenter/index?page=content\u0026id=jsa10939"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-bouncy-castle-affects-apache-solr-shipped-with-ibm-operations-analytics-log-analysis/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/79650"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-bouncy-castle-api-affect-ibm-license-metric-tool-v9/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-resilient-is-vulnerable-to-using-components-with-known-vulnerabilities/"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021042531"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/152620/red-hat-security-advisory-2019-0877-01.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.2340/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-bouncy-castle-vulnerabilities-affect-ibm-sterling-b2b-integrator/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.2561/"
},
{
"trust": 0.6,
"url": "https://www.ibm.com/blogs/psirt/security-bulletin-bouncy-castle-as-used-by-ibm-qradar-siem-contains-multiple-vulnerabilities-cve-2018-1000613-cve-2017-13098-cve-2018-1000180/"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10862"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2018-10862"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-8039"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10237"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/cve/cve-2018-8039"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/cve/cve-2018-10237"
},
{
"trust": 0.3,
"url": "https://www.bouncycastle.org"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2018-1114"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1114"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/?version=7.1"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2017-12624"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12624"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2018-1067"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1067"
},
{
"trust": 0.2,
"url": "https://issues.jboss.org/):"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/327.html"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/./dsa-4233"
},
{
"trust": 0.1,
"url": "https://tools.cisco.com/security/center/viewalert.x?alertid=60313"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/cybersource/cybersource-sdk-java"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-1000129"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1271"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2014-0114"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000342"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000352"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000346"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5397"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-14063"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-1000343"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-1338"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2017-14063"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000130"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-1000342"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-1000352"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1272"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-1000346"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000339"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-1000340"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-1000341"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000341"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.1/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-0114"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-8088"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000343"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-8036"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000344"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-1000345"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-1000338"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-1272"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=jboss.fuse\u0026downloadtype=distributions\u0026version=7.1.0"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000340"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1000129"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-1339"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1339"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000338"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/2939351"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-1000339"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-1271"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-1000130"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-8036"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-8088"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-5397"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1338"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2016-1000344"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-1000345"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=appplatform\u0026downloadtype=securitypatches\u0026version=7.1"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-10915"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/articles/2974891"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10915"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10894"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product\\xcatrhoar.thorntail\u0026version=2.4.0"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-19360"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-14718"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-14718"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-19361"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-10894"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-14719"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-14719"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12022"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-10912"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-12023"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10912"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-19360"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-19362"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-19362"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html-single/rhoar_thorntail_release_notes/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-12023"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-12022"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-11307"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-11307"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-19361"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/bouncycastle"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-119384"
},
{
"db": "VULMON",
"id": "CVE-2018-1000180"
},
{
"db": "BID",
"id": "106567"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006359"
},
{
"db": "PACKETSTORM",
"id": "149311"
},
{
"db": "PACKETSTORM",
"id": "148942"
},
{
"db": "PACKETSTORM",
"id": "149229"
},
{
"db": "PACKETSTORM",
"id": "152620"
},
{
"db": "PACKETSTORM",
"id": "148288"
},
{
"db": "PACKETSTORM",
"id": "148944"
},
{
"db": "PACKETSTORM",
"id": "148945"
},
{
"db": "CNNVD",
"id": "CNNVD-201806-332"
},
{
"db": "NVD",
"id": "CVE-2018-1000180"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-119384"
},
{
"db": "VULMON",
"id": "CVE-2018-1000180"
},
{
"db": "BID",
"id": "106567"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-006359"
},
{
"db": "PACKETSTORM",
"id": "149311"
},
{
"db": "PACKETSTORM",
"id": "148942"
},
{
"db": "PACKETSTORM",
"id": "149229"
},
{
"db": "PACKETSTORM",
"id": "152620"
},
{
"db": "PACKETSTORM",
"id": "148288"
},
{
"db": "PACKETSTORM",
"id": "148944"
},
{
"db": "PACKETSTORM",
"id": "148945"
},
{
"db": "CNNVD",
"id": "CNNVD-201806-332"
},
{
"db": "NVD",
"id": "CVE-2018-1000180"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-06-05T00:00:00",
"db": "VULHUB",
"id": "VHN-119384"
},
{
"date": "2018-06-05T00:00:00",
"db": "VULMON",
"id": "CVE-2018-1000180"
},
{
"date": "2018-04-18T00:00:00",
"db": "BID",
"id": "106567"
},
{
"date": "2018-08-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-006359"
},
{
"date": "2018-09-11T15:41:48",
"db": "PACKETSTORM",
"id": "149311"
},
{
"date": "2018-08-15T17:16:39",
"db": "PACKETSTORM",
"id": "148942"
},
{
"date": "2018-09-04T18:32:22",
"db": "PACKETSTORM",
"id": "149229"
},
{
"date": "2019-04-24T23:47:05",
"db": "PACKETSTORM",
"id": "152620"
},
{
"date": "2018-06-25T19:31:25",
"db": "PACKETSTORM",
"id": "148288"
},
{
"date": "2018-08-15T17:17:12",
"db": "PACKETSTORM",
"id": "148944"
},
{
"date": "2018-08-15T17:17:22",
"db": "PACKETSTORM",
"id": "148945"
},
{
"date": "2018-06-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201806-332"
},
{
"date": "2018-06-05T13:29:00.203000",
"db": "NVD",
"id": "CVE-2018-1000180"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-10-20T00:00:00",
"db": "VULHUB",
"id": "VHN-119384"
},
{
"date": "2023-11-07T00:00:00",
"db": "VULMON",
"id": "CVE-2018-1000180"
},
{
"date": "2019-07-17T07:00:00",
"db": "BID",
"id": "106567"
},
{
"date": "2018-08-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-006359"
},
{
"date": "2021-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201806-332"
},
{
"date": "2024-11-21T03:39:51.993000",
"db": "NVD",
"id": "CVE-2018-1000180"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201806-332"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Bouncy Castle BC and BC-FJA Cryptographic vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-006359"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201806-332"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.