After further analysis, in this project, the main Api called is <org.bouncycastle.math.ec.AbstractECMultiplier: org.bouncycastle.math.ec.ECPoint multiply(org.bouncycastle.math.ec.ECPoint,java.math.BigInteger)>
<org.bouncycastle.math.ec.AbstractECMultiplier: org.bouncycastle.math.ec.ECPoint multiply(org.bouncycastle.math.ec.ECPoint,java.math.BigInteger)>
at <org.bouncycastle.math.ec.ECPoint: org.bouncycastle.math.ec.ECPoint multiply(java.math.BigInteger)> (org.bouncycastle.math.ec.ECPoint.java:[-1]) in /.m2/repository/org/bouncycastle/bcprov-jdk15on/1.50/bcprov-jdk15on-1.50.jar
at <org.bouncycastle.crypto.prng.drbg.DualECSP800DRBG: int generate(byte[],byte[],boolean)> (org.bouncycastle.crypto.prng.drbg.DualECSP800DRBG.java:[-1]) in /.m2/repository/org/bouncycastle/bcprov-jdk15on/1.50/bcprov-jdk15on-1.50.jar
at <org.bouncycastle.crypto.prng.SP800SecureRandom: void nextBytes(byte[])> (org.bouncycastle.crypto.prng.SP800SecureRandom.java:[-1]) in /.m2/repository/org/bouncycastle/bcprov-jdk15on/1.50/bcprov-jdk15on-1.50.jar
at <org.wso2.msf4j.internal.session.SessionIdGenerator: void getRandomBytes(byte[])> (org.wso2.msf4j.internal.session.SessionIdGenerator.java:[126]) in /detect/unzip/msf4j-2.4.0/core/target/classes
Hi, In msf4j/core,there is a dependency org.bouncycastle:bcprov-jdk15on:1.50 that calls the risk method.
CVE-2015-7940
The scope of this CVE affected version is (,1.51)
After further analysis, in this project, the main Api called is <org.bouncycastle.math.ec.AbstractECMultiplier: org.bouncycastle.math.ec.ECPoint multiply(org.bouncycastle.math.ec.ECPoint,java.math.BigInteger)>
Risk method repair link : GitHub
CVE Bug Invocation Path--
Path Length : 5
Dependency tree--
Suggested solutions:
Update dependency version
Thank you very much.