Read the docs
TI-2018-15829 Aliases CVE-2018-1000180GHSA-xqj7-j8j5-f2xr

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the…

Priority LOW 39CWE-327Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 8 fixed, 7 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-327.

Summary

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.

Why it matters now

EPSS 0.0342 88th percentileScored 2026-11-07
Fix Partial org.bouncycastle:bcprov-jdk14 (Maven): 1.60org.bouncycastle:bcprov-jdk15 (Maven): 1.60+1 more productRed Hat: 7 advisoriesRed Hat: 8 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.bouncycastle:bcprov-jdk14 (Maven)before 1.601.60Patch availableGHSA-xqj7-j8j5-f2xr
—org.bouncycastle:bcprov-jdk15 (Maven)before 1.601.60Patch availableGHSA-xqj7-j8j5-f2xr
—org.bouncycastle:bcprov-jdk15on (Maven)before 1.601.60Patch availableGHSA-xqj7-j8j5-f2xr
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.bouncycastle:bcprov-jdk14 (Maven) Vendor— Affected before 1.60 Fixed in 1.60 Patch available GHSA-xqj7-j8j5-f2xr
  • org.bouncycastle:bcprov-jdk15 (Maven) Vendor— Affected before 1.60 Fixed in 1.60 Patch available GHSA-xqj7-j8j5-f2xr
  • org.bouncycastle:bcprov-jdk15on (Maven) Vendor— Affected before 1.60 Fixed in 1.60 Patch available GHSA-xqj7-j8j5-f2xr

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*1.54 – 1.59VulnerableLegion of the Bouncy Castle Inc.
cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:*up to 1.0.1VulnerableLegion of the Bouncy Castle Inc.
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*11.1.2.4.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_transaction_management:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:*3.7.1VulnerableOracle
cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:*3.8.0VulnerableOracle
  • cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:* Versions 1.54 – 1.59 Vulnerable ·Legion of the Bouncy Castle Inc.
  • cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:* Versions up to 1.0.1 Vulnerable ·Legion of the Bouncy Castle Inc.
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:* Versions 11.1.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_transaction_management:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:* Versions 3.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:* Versions 3.8.0 Vulnerable ·Oracle
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*before 7.0.0.1VulnerableOracle
cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:*before 7.2VulnerableOracle
cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*8.55VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*8.56VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*8.57VulnerableOracle
cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.8.1:*:*:*:*:*:*:*2.8.1VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
cpe:2.3:a:oracle:soa_suite:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:soa_suite:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*11.1.1.9.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:redhat:virtualization:4.2:*:*:*:*:*:*:*4.2VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*7.1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
  • cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:* Versions before 7.0.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:* Versions before 7.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:* Versions 8.55 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:soa_suite:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:soa_suite:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:redhat:virtualization:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat

Remediation

  • Fix · GHSA-xqj7-j8j5-f2xr org.bouncycastle:bcprov-jdk14 (Maven) Fixed in 1.60 Advisory →
  • Fix · GHSA-xqj7-j8j5-f2xr org.bouncycastle:bcprov-jdk15 (Maven) Fixed in 1.60 Advisory →
  • Fix · GHSA-xqj7-j8j5-f2xr org.bouncycastle:bcprov-jdk15on (Maven) Fixed in 1.60 Advisory →

Red Hat 7 advisories

  • RHSA-2019:0877 Released 2019-04-24 · Red Hat rating Important
    Red Hat OpenShift Application Runtimes Thorntail 2.4.0 security & bug fix update
    • Text-Only RHOAR
  • RHSA-2018:2669 Released 2018-09-11 · Red Hat rating Important
    Fuse 7.1 security update
    • Red Hat Fuse 7
  • RHSA-2018:2643 Released 2018-09-04 · Red Hat rating Important
    rhvm-appliance security update
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-2:4.2-20180828.0.el7
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-2:4.2-20180828.0.el7
Show 4 more Red Hat advisories
  • RHSA-2018:2424 Released 2018-08-15 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.013-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.013-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.013-1.redhat_1.1.ep7.el7 +47
  • RHSA-2018:2423 Released 2018-08-15 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.013-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.013-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.013-1.redhat_1.1.ep7.el6 +47
  • RHSA-2018:2428 Released 2018-08-15 · Red Hat rating Important
    Red Hat Single Sign-On 7.2.4 security update
    • Red Hat Single Sign-On 7.2.4 zip
  • RHSA-2018:2425 Released 2018-08-15 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1 security update
    • Red Hat JBoss EAP 7.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
JBoss Developer Studio 11AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Integration Service 2AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Satellite 6AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Fuse 7Fixed RHSA-2018:2669
Red Hat JBoss EAP 7.1Fixed RHSA-2018:2425
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2018:2423
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2018:2424
Red Hat Single Sign-On 7.2.4 zipFixed RHSA-2018:2428
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2018:2643
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2018:2643
Text-Only RHOARFixed RHSA-2019:0877
Not affected: 3 products
  • Red Hat JBoss Data Grid 7
  • Red Hat Single Sign-On 7
  • Red Hat Subscription Asset Manager

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1000180
  2. 2026-10-03 Alias added: GHSA-xqj7-j8j5-f2xr
  3. 2026-11-03 Fix available: Red Hat Fuse 7 · Red Hat

References

Patch 5

Advisory 11

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences