Vulnerability CVE-2018-5382


Published: 2018-04-16

Description:
Bouncy Castle BKS version 1 keystore (BKS-V1) files use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS-V1 keystore. All BKS-V1 keystores are vulnerable. Bouncy Castle release 1.47 introduces BKS version 2, which uses a 160-bit MAC.

 References:
https://www.bouncycastle.org/releasenotes.html
https://www.kb.cert.org/vuls/id/306792

Copyright 2018, cxsecurity.com

 

Back to Top