CVE-2022-45146: Use After Free
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-45146?
CVE-2022-45146 is a vulnerability found in the FIPS Java API of Bouncy Castle BC-FJA before version 1.0.2.4.
What is the severity of CVE-2022-45146?
The severity of CVE-2022-45146 is medium, with a CVSS score of 5.5.
How does CVE-2022-45146 affect Bouncy Castle BC-FJA?
CVE-2022-45146 affects Bouncy Castle BC-FJA before version 1.0.2.4, where changes to the JVM garbage collector in Java 13 and later can cause temporary keys used by the module to be zeroed out while still in use.
How can I fix CVE-2022-45146?
To fix CVE-2022-45146, update the Bouncy Castle BC-FJA to version 1.0.2.4 or later.
Are Oracle JDK versions vulnerable to CVE-2022-45146?
No, Oracle JDK versions are not vulnerable to CVE-2022-45146.