Bugzilla – Bug 1096291
VUL-0: CVE-2018-1000180: bouncycastle: flaw in the low-level interface to RSA key pair generator
Last modified: 2022-08-01 10:55:55 UTC
CVE-2018-1000180 Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000180 http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-1000180.html https://www.bountysource.com/issues/58293083-rsa-key-generation-computation-of-iterations-for-mr-primality-test https://www.bouncycastle.org/jira/browse/BJA-694 https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839 https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad
Fixed in the update to version 1.60 for Leap 15.0, 43.2 and Factory. Patches for this fix are: https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839.patch and https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad.patch I just mentioned the bug and the CVE numbers in the changelog: Factory https://build.opensuse.org/request/show/635776 Leap 15.0 https://build.opensuse.org/request/show/635779
Also submitted to Leap 42.3: https://build.opensuse.org/request/show/635789 This should fix the build problems mentioned in: https://bugzilla.suse.com/show_bug.cgi?id=1100694#c7 The problem was that the Factory version of bouncycastle included the line (%{_datadir}/maven-metadata/%{name}.xml) that triggers an error in 42.3 which must be substituted by (%{_mavendepmapfragdir}/%{name}), which works on the server builders but not locally, maybe because there is some definition missing. This means that Leap 42.3 should not use the sources from Factory now.
openSUSE-SU-2018:2820-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1096291 CVE References: CVE-2018-1000180 Sources used: openSUSE Leap 42.3 (src): bouncycastle-1.60-23.10.1
Fixed. Closing.