CVE-2022-45146 - CVE House
Back to Database
Status published Medium CVE-2022-45146

An issue was discovered in the FIPS Java API of...

Vulnerability Description

An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-45146

Credits & Attribution

No credits recorded in the NVD database.

References

More from bouncycastle

View All →
CVE-2020-28052
An issue was discovered in Legion of the Bouncy Castle...
High 8.1
CVE-2020-26939
In Legion of the Bouncy Castle BC before 1.61 and...
Medium 5.3
CVE-2020-15522
Bouncy Castle BC Java before 1.66, BC C# .NET before...
Medium 5.9
CVE-2019-17359
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java)...
High 7.5
CVE-2018-1000613
Legion of the Bouncy Castle Legion of the Bouncy Castle...
Critical 9.8

Affected Vendor

bouncycastle

View all reports →

Affected Software

fips java api
Vulnerable Versions:
0

Timeline

Official Publish: November 21st, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.