GHSA-rrvx-pwf8-p59pHighCVSS 7.5

In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values

Published
October 17, 2018
Last Modified
September 12, 2025

🔗 CVE IDs covered (1)

📋 Description

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.

🎯 Affected products3

  • maven/org.bouncycastle:bcprov-jdk14:< 1.56
  • maven/org.bouncycastle:bcprov-jdk15:< 1.56
  • maven/org.bouncycastle:bcprov-jdk15on:< 1.56

🔗 References (10)