CVE-2022-45146

 

Published at: - 21-11-2022 11:15

Last modified: - 21-11-2022 02:00

Total changes: - 1

Description

An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://www.bouncycastle.org/latest_releases.html
• https://github.com/bcgit/bc-java/wiki/CVE-2022-45146

 

Keywords

NVD

 

CVE-2022-45146

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures