https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:20:14 +0000 https://cve.radiocsirt.org/vuln/certfr-2020-avi-420 certfr-2020-avi-420 https://cve.radiocsirt.org/vuln/certfr-2020-avi-420 https://cve.radiocsirt.org/vuln/cnvd-2018-09770 cnvd-2018-09770 https://cve.radiocsirt.org/vuln/cnvd-2018-09770 https://cve.radiocsirt.org/vuln/euvd-2026-163994 EUVD-2026-163994 https://cve.radiocsirt.org/vuln/euvd-2026-163994 https://cve.radiocsirt.org/vuln/fkie_cve-2018-5382 <p>The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type &#34;BKS-V1&#34; was introduced in 1.49. It should be noted that the use of &#34;BKS-V1&#34; is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.</p> <p>The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type &#34;BKS-V1&#34; was introduced in 1.49. It should be noted that the use of &#34;BKS-V1&#34; is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-5382 https://cve.radiocsirt.org/vuln/ghsa-8477-3v39-ggpm <p><strong>Affected:</strong> Maven: org.bouncycastle:bcprov-jdk15on</p> <p>The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type &#34;BKS-V1&#34; was introduced in 1.49. It should be noted that the use of &#34;BKS-V1&#34; is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.</p> <p><strong>Affected:</strong> Maven: org.bouncycastle:bcprov-jdk15on</p> <p>The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type &#34;BKS-V1&#34; was introduced in 1.49. It should be noted that the use of &#34;BKS-V1&#34; is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.</p> https://cve.radiocsirt.org/vuln/ghsa-8477-3v39-ggpm https://cve.radiocsirt.org/vuln/gsd-2018-5382 gsd-2018-5382 https://cve.radiocsirt.org/vuln/gsd-2018-5382 https://cve.radiocsirt.org/vuln/rhsa-2018:2927 <p>bouncycastle: Information disclosure in GCMBlockCipher bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data bouncycastle: Information leak in AESFastEngine class bouncycastle: Carry propagation bug in math.raw.Nat??? class bouncycastle: Information exposure in DSA signature generation via timing attack bouncycastle: ECDSA improper validation of ASN.1 encoding of signature bouncycastle: DSA key pair generator generates a weak private key by default bouncycastle: DHIES implementation allowed the use of ECB mode bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack bouncycastle: Other party DH public keys are not fully validated bouncycastle: ECIES implementation allowed the use of ECB mode logback: Serialization vulnerability in SocketServer and ServerSocketReceiver python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs hibernate-validator: Privilege escalation when running under the security manager puppet: Unpacking of tarballs in tar/mini.rb can create files with insecure permissions puppet: Environment leakage in puppet-agent 6: XSS in discovery rule filter autocomplete functionality jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) foreman: Stored XSS in fact name or value pulp: sensitive credentials revealed through the API foreman: SQL injection due to improper handling of the widget…</p> <p>bouncycastle: Information disclosure in GCMBlockCipher bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data bouncycastle: Information leak in AESFastEngine class bouncycastle: Carry propagation bug in math.raw.Nat??? class bouncycastle: Information exposure in DSA signature generation via timing attack bouncycastle: ECDSA improper validation of ASN.1 encoding of signature bouncycastle: DSA key pair generator generates a weak private key by default bouncycastle: DHIES implementation allowed the use of ECB mode bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack bouncycastle: Other party DH public keys are not fully validated bouncycastle: ECIES implementation allowed the use of ECB mode logback: Serialization vulnerability in SocketServer and ServerSocketReceiver python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs hibernate-validator: Privilege escalation when running under the security manager puppet: Unpacking of tarballs in tar/mini.rb can create files with insecure permissions puppet: Environment leakage in puppet-agent 6: XSS in discovery rule filter autocomplete functionality jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) foreman: Stored XSS in fact name or value pulp: sensitive credentials revealed through the API foreman: SQL injection due to improper handling of the widget…</p> https://cve.radiocsirt.org/vuln/rhsa-2018:2927 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-5382 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: bouncycastle, Ubuntu:16.04:LTS: bouncycastle</p> <p>The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type &#34;BKS-V1&#34; was introduced in 1.49. It should be noted that the use of &#34;BKS-V1&#34; is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: bouncycastle, Ubuntu:16.04:LTS: bouncycastle</p> <p>The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type &#34;BKS-V1&#34; was introduced in 1.49. It should be noted that the use of &#34;BKS-V1&#34; is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-5382