Insecure encryption algorithm In org.bouncycastle:bcprov-jdk15
Description
In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 maven | 1.56 | ||
maven | 1.56 | ||
 debian 11 | 1.56-1 | ||
maven | 1.56 | ||
debian 12 | 1.56-1 | ||
debian 13 | 1.56-1 | ||
debian 14 | 1.56-1 |
Aliases
References