CVE-2022-45146

What it actually does

Temporary cryptographic keys used by the BC-FJA FIPS module can be zeroed by JVM garbage collection changes in Java 13+ while still referenced, producing a use-after-free condition that leads to errors or information loss.

Why it matters to the business

Applications relying on the affected library on Java 13 and newer may experience cryptographic failures or data exposure, increasing operational risk and potential compliance issues; widespread downstream use amplifies exposure across dependent projects.

How an attack unfolds

An attacker with local access runs code that forces JVM garbage collection at precise moments during key operations in the FIPS module, causing in-use keys to be cleared and resulting in errors or partial information disclosure.

How to fix it

Upgrade affected Microweber installations to the fixed commit 955471c27e671c49e4b012e3b120b004082ac3f7 or later; on Java 13+ ensure the Bouncy Castle FIPS module is at least version 1.0.2.4.

How to confirm the fix worked

Confirm the installed library version is 1.0.2.4 or newer, run regression tests exercising FIPS cryptographic operations under Java 13+, and verify absence of zeroed-key errors in logs.

Typical attack path

1. Identify hosts or containers running Java 13+ with the vulnerable Bouncy Castle FIPS module
2. Deploy or execute local code that triggers repeated garbage collection during cryptographic key usage
3. Observe resulting errors or attempt to capture residual data from the cleared key material

How to detect it

Review application and JVM logs for unexpected cryptographic errors or key-related exceptions during operations; correlate with process execution of local untrusted code on systems running Java 13+.

What your security team should do

• Prioritize upgrade of all Microweber instances to the listed fixed commit within the next patching cycle
• Audit Java runtime versions in use and restrict FIPS module deployments to certified Java 7/8/11 where possible
• Add library version checks to dependency scanning pipelines to prevent reintroduction of the vulnerable component