CVE-2022-45146

Katalog CVE

CVSS 5.5 · Medium EPSS 0,43%

Kerentanan Use After Free pada bouncycastle fips java api. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.

Rincian

Terbit di NVD

21 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.bouncycastle.org/latest_releases.html release notes · advisory vendor
• https://github.com/bcgit/bc-java/wiki/CVE-2022-45146 exploit · advisory pihak ketiga
• https://mvnrepository.com/artifact/org.bouncycastle/bc-fips