CVE-2018-5382
lowPriorität · verfolgen · 18OT-Risiko · erhöhtEPSS 0.003 · 17. PerzentilEUUSEPSS · bewertet 2026-10-24
The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.6–4.4
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (5)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-8477-3v39-ggpmImproper Validation of Integrity Check Value in Bouncy Castle2022-05-13ghsa · osvUS
The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (20)
Externe Belege — Patches, Meldungen, Analysen.
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10939cnnvd
- https://access.redhat.com/errata/RHSA-2018:2927cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.2561/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.3850/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.2340/cnnvd
- https://www.bouncycastle.org/releasenotes.htmlcnnvd
- https://www.ibm.com/support/pages/node/960296cnnvd
- https://www.kb.cert.org/vuls/id/306792cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan