CVE-2018-1000180

26

FAUCET Score

CVE-2018-1000180 describes a vulnerability in the Bouncy Castle cryptographic library (versions 1.54-1.59 and BC-FJA 1.0.0-1.0.1), where RSA key pairs generated using its low-level API might have fewer Miller-Rabin primality tests than expected, potentially weakening the keys. This flaw impacts products utilizing these affected Bouncy Castle versions, including Debian, NetApp, Oracle, and Red Hat. With a CVSS score of 7.5 (High), the vulnerability is network-exploitable with low attack complexity, allowing for potential compromise of confidentiality without requiring user interaction. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.54, <= 1.59CPE matchmatch criteria	cpe:2.3:a:bouncycastle:bc-java::::::::
		<= 1.0.1CPE matchmatch criteria	cpe:2.3:a:bouncycastle:fips_java_api::::::::
		9.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:9.0:::::::*
		11.1.2.4.0CPE matchmatch criteria	cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:::::::*
		11.1.1.9.0CPE matchmatch criteria	cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:::::::*

CVSS Data

CVSS version used by this source: 3.0

7.5HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.0

Exploit Intelligence

EPSS Score

3.62%

Probability of exploitation in next 30 days

EPSS Percentile

88.3%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.0362 is in the 79th percentile among its peer group of 51,466 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (56)

github_advisorypatch availablevia nvd_reference

mavenpatch availablevia ghsa

Product: org.bouncycastle:bcprov-jdk15Fixed in: 1.60

mavenpatch availablevia ghsa

Product: org.bouncycastle:bcprov-jdk15onFixed in: 1.60

mavenpatch availablevia ghsa

Product: org.bouncycastle:bcprov-jdk14Fixed in: 1.60

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-hibernate-0:5.1.15-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-ironjacamar-0:1.4.10-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jberet-0:1.2.6-2.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jboss-ejb-client-0:4.0.11-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jboss-remoting-0:5.0.8-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-jboss-server-migration-0:1.0.6-4.Final_redhat_4.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-mod_cluster-0:1.3.10-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-narayana-0:5.5.32-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-picketlink-bindings-0:2.5.5-13.SP12_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-picketlink-federation-0:2.5.5-13.SP12_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-resteasy-0:3.0.26-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-undertow-0:1.4.18-7.SP8_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-0:7.1.4-1.GA_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-javadocs-0:7.1.4-2.GA_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-naming-client-0:1.0.9-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-openssl-linux-0:1.0.6-14.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-transaction-client-0:1.0.4-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-wildfly-web-console-eap-0:2.9.18-1.Final_redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-activemq-artemis-0:1.5.5.013-1.redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-bouncycastle-0:1.56.0-5.redhat_3.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-guava-libraries-0:25.0.0-1.redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-hibernate-0:5.1.15-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-ironjacamar-0:1.4.10-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jberet-0:1.2.6-2.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jboss-ejb-client-0:4.0.11-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jboss-remoting-0:5.0.8-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-jboss-server-migration-0:1.0.6-4.Final_redhat_4.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-mod_cluster-0:1.3.10-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-narayana-0:5.5.32-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-picketlink-bindings-0:2.5.5-13.SP12_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-picketlink-federation-0:2.5.5-13.SP12_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-resteasy-0:3.0.26-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss EAP 7.1Fixed in: bouncycastle

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-activemq-artemis-0:1.5.5.013-1.redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-bouncycastle-0:1.56.0-5.redhat_3.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6Fixed in: eap7-guava-libraries-0:25.0.0-1.redhat_1.1.ep7.el6

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Fuse 7Fixed in: bouncycastle

redhatpatch availablevia redhat_api

Product: Red Hat Single Sign-On 7.2.4 zipFixed in: bouncycastle

redhatpatch availablevia redhat_api

Product: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7Fixed in: rhvm-appliance-0:4.2-20180828.0.el7

redhatpatch availablevia redhat_api

Product: Text-Only RHOAR

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-undertow-0:1.4.18-7.SP8_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-0:7.1.4-1.GA_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-javadocs-0:7.1.4-2.GA_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-naming-client-0:1.0.9-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-openssl-linux-0:1.0.6-14.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-transaction-client-0:1.0.4-1.Final_redhat_1.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7Fixed in: eap7-wildfly-web-console-eap-0:2.9.18-1.Final_redhat_1.1.ep7.el7

redhatno patchvia redhat_api

Product: Red Hat OpenShift Application RuntimesFixed in: bouncycastle

redhatend of lifevia redhat_api

Product: Red Hat Software CollectionsFixed in: rh-eclipse46-bouncycastle

redhatend of lifevia redhat_api

Product: Red Hat Satellite 6Fixed in: bouncycastle

redhatend of lifevia redhat_api

Product: Red Hat JBoss Fuse 6Fixed in: bouncycastle

Vendor Advisories (2)

mavenGHSA-xqj7-j8j5-f2xrhigh

Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator

redhatCVE-2018-1000180Moderate

bouncycastle: flaw in the low-level interface to RSA key pair generator

References

access.redhat.com / errata/RHSA-2018:2423

Third Party Advisory

access.redhat.com / errata/RHSA-2018:2424

Third Party Advisory

access.redhat.com / errata/RHSA-2018:2425

Third Party Advisory

access.redhat.com / errata/RHSA-2018:2428

Third Party Advisory

access.redhat.com / errata/RHSA-2018:2643

Third Party Advisory

access.redhat.com / errata/RHSA-2018:2669

Third Party Advisory

access.redhat.com / errata/RHSA-2019:0877

Third Party Advisory

github.com / bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad

PatchThird Party Advisory

github.com / bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839

PatchThird Party Advisory

github.com / bcgit/bc-java/wiki/CVE-2018-1000180

lists.apache.org / thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

security.netapp.com / advisory/ntap-20190204-0003

PatchThird Party Advisory

bountysource.com / issues/58293083-rsa-key-generation-computation-of-iterations-for-mr-primality-test

Third Party Advisory

debian.org / security/2018/dsa-4233

Third Party Advisory

oracle.com / security-alerts/cpuapr2020.html

oracle.com / security-alerts/cpuApr2021.html

oracle.com / security-alerts/cpuoct2020.html

oracle.com / technetwork/security-advisory/cpuapr2019-5072813.html

PatchThird Party Advisory

oracle.com / technetwork/security-advisory/cpujan2019-5072801.html

PatchThird Party Advisory

oracle.com / technetwork/security-advisory/cpujul2019-5072835.html

securityfocus.com / bid/106567

Third Party AdvisoryVDB Entry