| Package | Affected versions | Patched versions |
|---|---|---|
| org.bouncycastle:bcprov-jdk14 | < 1.60 | 1.60 |
| org.bouncycastle:bcprov-jdk15 | < 1.60 | 1.60 |
| org.bouncycastle:bcprov-jdk15on | < 1.60 | 1.60 |
| bc-java | ≥ 1.54, ≤ 1.59 | |
| fips java api | ≤ 1.0.1 | |
| api gateway | = 11.1.2.4.0 | |
| business process management suite | = 11.1.1.9.0= 12.1.3.0.0= 12.2.1.3.0 | |
| business transaction management | = 12.1.0 | |
| communications application session controller | = 3.7.1= 3.8.0 | |
| communications converged application server | < 7.0.0.1 | 7.0.0.1 |
| communications webrtc session controller | < 7.2 | 7.2 |
| enterprise repository | = 12.1.3.0.0 | |
| managed file transfer | = 12.1.3.0.0= 12.2.1.3.0 | |
| peoplesoft enterprise peopletools | = 8.55= 8.56= 8.57 | |
| retail convenience and fuel pos software | = 2.8.1 | |
| retail xstore point of service | = 7.0= 7.1 | |
| soa suite | = 12.1.3.0.0= 12.2.1.3.0 | |
| webcenter portal | = 11.1.1.9.0= 12.2.1.3.0 | |
| weblogic server | = 12.1.3.0.0 | |
| jboss enterprise application platform | = 7.1.0 |
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free