Bug 1096291 - (CVE-2018-1000180) VUL-0: CVE-2018-1000180: bouncycastle: flaw in the low-level interface to RSA key pair generator
(CVE-2018-1000180)
VUL-0: CVE-2018-1000180: bouncycastle: flaw in the low-level interface to RSA...
Status: RESOLVED FIXED
Classification: openSUSE
Product: openSUSE Distribution
Classification: openSUSE
Component: Security
Leap 15.0
Other Other
: P3 - Medium : Normal (vote)
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/207267/
CVSSv3.1:SUSE:CVE-2018-1000180:4.8:(...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-06-06 16:13 UTC by Alexander Bergmann
Modified: 2022-08-01 10:55 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2018-06-06 16:13:58 UTC
CVE-2018-1000180

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw
in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs
generated in low-level API with added certainty may have less M-R tests than
expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA
1.0.2 and later.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000180
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-1000180.html
https://www.bountysource.com/issues/58293083-rsa-key-generation-computation-of-iterations-for-mr-primality-test
https://www.bouncycastle.org/jira/browse/BJA-694
https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839
https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad
Comment 1 Pedro Monreal Gonzalez 2018-09-14 14:52:29 UTC
Fixed in the update to version 1.60 for Leap 15.0, 43.2 and Factory. Patches for this fix are:

https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839.patch

and

https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad.patch

I just mentioned the bug and the CVE numbers in the changelog:

Factory    https://build.opensuse.org/request/show/635776
Leap 15.0  https://build.opensuse.org/request/show/635779
Comment 2 Pedro Monreal Gonzalez 2018-09-14 15:51:27 UTC
Also submitted to Leap 42.3:
https://build.opensuse.org/request/show/635789

This should fix the build problems mentioned in:

https://bugzilla.suse.com/show_bug.cgi?id=1100694#c7

The problem was that the Factory version of bouncycastle included the line (%{_datadir}/maven-metadata/%{name}.xml) that triggers an error in 42.3 which must be substituted by (%{_mavendepmapfragdir}/%{name}), which works on the server builders but not locally, maybe because there is some definition missing.

This means that Leap 42.3 should not use the sources from Factory now.
Comment 3 Swamp Workflow Management 2018-09-24 13:08:45 UTC
openSUSE-SU-2018:2820-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1096291
CVE References: CVE-2018-1000180
Sources used:
openSUSE Leap 42.3 (src):    bouncycastle-1.60-23.10.1
Comment 5 Wolfgang Frisch 2020-01-16 14:02:41 UTC
Fixed. Closing.