GHSA-rrvx-pwf8-p59p In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values

• Maven org.bouncycastle:bcprov-jdk14: < 1.56 → fixed in 1.56 • Maven org.bouncycastle:bcprov-jdk15: < 1.56 → fixed in 1.56 • Maven org.bouncycastle:bcprov-jdk15on: < 1.56 → fixed in 1.56

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.