In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
| Link | Tags |
|---|---|
| https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html | third party advisory mailing list |
| https://access.redhat.com/errata/RHSA-2018:2669 | vendor advisory |
| https://usn.ubuntu.com/3727-1/ | vendor advisory |
| https://access.redhat.com/errata/RHSA-2018:2927 | vendor advisory |
| https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E | mailing list |
| https://www.oracle.com/security-alerts/cpuoct2020.html | |
| https://security.netapp.com/advisory/ntap-20181127-0004/ | |
| https://github.com/bcgit/bc-java/commit/50a53068c094d6cff37659da33c9b4505becd389#diff-5578e61500abb2b87b300d3114bdfd7d | third party advisory patch |