Advisory details:
github_osv / GHSA-68m8-v89j-7j2p
| Advisory ID | github_osv/GHSA-68m8-v89j-7j2p |
| Aliases |
CVE-2022-45146
|
| Summary | Garbage collection issue in BC-FJA in Java 13 and later An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.0 |
| Risk | 2.5 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-416 | Use After Free |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 5.5 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-68m8-v89j-7j2p/GHSA-68m8-v89j-7j2p.json |
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://mvnrepository.com/artifact/org.bouncycastle/bc-fips | ||
| https://www.bouncycastle.org/latest_releases.html | ||
| CVE-2022-45146 | https://github.com/bcgit/bc-java/wiki/CVE-2022-45146 | |
| CVE-2022-45146 | https://nvd.nist.gov/vuln/detail/CVE-2022-45146 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.