High
Security advisory
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-1000180
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:16 UTC · Revision 1
Source evidence
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
osv:CVE-2018-1000180
Complete source record
{
"id": "9588dbb6280edd7232595ce2219a833d972dd44d6e19a6ae61bdda4d9f84a000",
"url": "https://osv.dev/vulnerability/CVE-2018-1000180",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-1000180",
"summary": "Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.",
"evidence": "osv:CVE-2018-1000180",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2018-1000180",
"aliases": [
"CVE-2018-1000180",
"GHSA-xqj7-j8j5-f2xr"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/bcgit/bc-java",
"type": "GIT",
"events": [
{
"introduced": "47dc38fa0e7e4ad000f37f66474788d74dce8c93"
},
{
"last_affected": "6de1c17dda8ffdb19431ffcadbce1836867a27a9"
},
{
"fixed": "22467b6e8fe19717ecdf201c0cf91bacf04a55ad"
},
{
"fixed": "73780ac522b7795fc165630aba8d5f5729acc839"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.54"
},
{
"last_affected": "1.59"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "22467b6e8fe19717ecdf201c0cf91bacf04a55ad"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "73780ac522b7795fc165630aba8d5f5729acc839"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"r1rv59",
"r1rv58",
"r1rv57",
"r1rv56",
"r1rv55",
"r1rv54"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000180.json",
"vanir_signatures": [
{
"id": "CVE-2018-1000180-4be11a56",
"digest": {
"threshold": 0.9,
"line_hashes": [
"257698838932714443289646009555494598341",
"289848681659626294251947604395719801481",
"156915566116362155606891889355124502872",
"26895649160699150255602757069596481226",
"220811889832895347815946836515128187770",
"47045332555838027236932019877537168760",
"22919438933150866736858579667051393581",
"143814390065555812665951859181297093884",
"237451756451439053358303576206498505327",
"277246556836375319833842980669284337346",
"130689352777683059142271724779473551753",
"336435536837793534198724193478017402442",
"17704946286379027993761977778742095203",
"260155809973710943641365639216995634088",
"7377602204838434508197526472147943878",
"187118732279990443988316599001482697228",
"214681161194493830139928104179165807571",
"250657119348606598417294254264344680167",
"144151817570865529575959812164844930523",
"90485390753289015655808852128637265999"
]
},
"source": "https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839",
"target": {
"file": "core/src/main/java/org/bouncycastle/crypto/generators/RSAKeyPairGenerator.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000180-5e3a00a7",
"digest": {
"length": 160,
"function_hash": "26046904150781172814100366087529876009"
},
"source": "https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839",
"target": {
"file": "core/src/main/java/org/bouncycastle/crypto/generators/RSAKeyPairGenerator.java",
"function": "init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000180-81d64e88",
"digest": {
"length": 525,
"function_hash": "48298570206855095622110672320160068254"
},
"source": "https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839",
"target": {
"file": "core/src/main/java/org/bouncycastle/crypto/generators/RSAKeyPairGenerator.java",
"function": "chooseRandomPrime"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2018-1000180-81d898a1",
"digest": {
"length": 140,
"function_hash": "315724511571408902034389038163610651938"
},
"source": "https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839",
"target": {
"file": "core/src/main/java/org/bouncycastle/crypto/generators/RSAKeyPairGenerator.java",
"function": "isProbablePrime"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:25:28Z"
}
}
],
"modified": "2026-10-20T13:25:28.095730818Z",
"provider": "osv",
"references": [
"https://github.com/bcgit/bc-java/wiki/CVE-2018-1000180",
"https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://access.redhat.com/errata/RHSA-2018:2423",
"https://access.redhat.com/errata/RHSA-2018:2424",
"https://access.redhat.com/errata/RHSA-2018:2425",
"https://access.redhat.com/errata/RHSA-2018:2428",
"https://access.redhat.com/errata/RHSA-2018:2643",
"https://access.redhat.com/errata/RHSA-2018:2669",
"https://access.redhat.com/errata/RHSA-2019:0877",
"https://www.bountysource.com/issues/58293083-rsa-key-generation-computation-of-iterations-for-mr-primality-test",
"https://www.debian.org/security/2018/dsa-4233",
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad",
"https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839",
"https://security.netapp.com/advisory/ntap-20190204-0003/",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:bouncycastle:fips_java_api:*:*:*:*:*:*:*:*"
],
"vendor_product": "bouncycastle:fips_java_api",
"extracted_events": [
{
"range": [
{
"last_affected": "1.0.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_converged_application_server",
"extracted_events": [
{
"range": [
{
"fixed": "7.0.0.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_webrtc_session_controller",
"extracted_events": [
{
"range": [
{
"fixed": "7.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:api_gateway",
"extracted_events": [
{
"range": [
{
"introduced": "11.1.2.4.0"
},
{
"last_affected": "11.1.2.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:business_process_management_suite",
"extracted_events": [
{
"range": [
{
"introduced": "11.1.1.9.0"
},
{
"last_affected": "11.1.1.9.0"
},
{
"introduced": "12.1.3.0.0"
},
{
"last_affected": "12.1.3.0.0"
},
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:business_transaction_management:12.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:business_transaction_management",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.0"
},
{
"last_affected": "12.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_application_session_controller",
"extracted_events": [
{
"range": [
{
"introduced": "3.7.1"
},
{
"last_affected": "3.7.1"
},
{
"introduced": "3.8.0"
},
{
"last_affected": "3.8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:enterprise_repository:12.1.3.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:enterprise_repository",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.3.0.0"
},
{
"last_affected": "12.1.3.0.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:managed_file_transfer:12.1.3.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:managed_file_transfer",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.3.0.0"
},
{
"last_affected": "12.1.3.0.0"
},
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:peoplesoft_enterprise_peopletools",
"extracted_events": [
{
"range": [
{
"introduced": "8.55"
},
{
"last_affected": "8.55"
},
{
"introduced": "8.56"
},
{
"last_affected": "8.56"
},
{
"introduced": "8.57"
},
{
"last_affected": "8.57"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_convenience_and_fuel_pos_software:2.8.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_convenience_and_fuel_pos_software",
"extracted_events": [
{
"range": [
{
"introduced": "2.8.1"
},
{
"last_affected": "2.8.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_xstore_point_of_service",
"extracted_events": [
{
"range": [
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
},
{
"introduced": "7.1"
},
{
"last_affected": "7.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:soa_suite:12.1.3.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:soa_suite:12.2.1.3.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:soa_suite",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.3.0.0"
},
{
"last_affected": "12.1.3.0.0"
},
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:webcenter_portal",
"extracted_events": [
{
"range": [
{
"introduced": "11.1.1.9.0"
},
{
"last_affected": "11.1.1.9.0"
},
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:weblogic_server",
"extracted_events": [
{
"range": [
{
"introduced": "12.1.3.0.0"
},
{
"last_affected": "12.1.3.0.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:jboss_enterprise_application_platform",
"extracted_events": [
{
"range": [
{
"introduced": "7.1.0"
},
{
"last_affected": "7.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:virtualization:4.2:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:virtualization",
"extracted_events": [
{
"range": [
{
"introduced": "4.2"
},
{
"last_affected": "4.2"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-1000180",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387668,
"published_at": "2018-06-05T13:29:00.203+00:00"
}