VulnerableCode Package Details - pkg:maven/org.bouncycastle/bcprov-ext-jdk15on@1.70

Search for packages

Vulnerability	Summary	Fixed by
VCID-d6h1-yem6-qkhh Aliases: CVE-2023-33202 GHSA-wjxj-5m7g-mg7q	Bouncy Castle Denial of Service (DoS) Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.	1.73 Affected by 0 other vulnerabilities.
VCID-f8vc-nspc-qyfj Aliases: CVE-2023-33201 GHSA-hr8g-6v94-x4m9	Bouncy Castle For Java LDAP injection vulnerability Bouncy Castle provides the `X509LDAPCertStoreSpi.java` class which can be used in conjunction with the CertPath API for validating certificate paths. Pre-1.73 the implementation did not check the X.500 name of any certificate, subject, or issuer being passed in for LDAP wild cards, meaning the presence of a wild car may lead to Information Disclosure. A potential attack would be to generate a self-signed certificate with a subject name that contains special characters, e.g: `CN=Subject*)(objectclass=`. This will be included into the filter and provides the attacker ability to specify additional attributes in the search query. This can be exploited as a blind LDAP injection: an attacker can enumerate valid attribute values using the boolean blind injection technique. The exploitation depends on the structure of the target LDAP directory, as well as what kind of errors are exposed to the user. Changes to the `X509LDAPCertStoreSpi.java` class add the additional checking of any X.500 name used to correctly escape wild card characters.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-d6h1-yem6-qkhh
Aliases:
CVE-2023-33202
GHSA-wjxj-5m7g-mg7q

Bouncy Castle Denial of Service (DoS) Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.

1.73
Affected by 0 other vulnerabilities.

VCID-f8vc-nspc-qyfj
Aliases:
CVE-2023-33201
GHSA-hr8g-6v94-x4m9

Bouncy Castle For Java LDAP injection vulnerability Bouncy Castle provides the `X509LDAPCertStoreSpi.java` class which can be used in conjunction with the CertPath API for validating certificate paths. Pre-1.73 the implementation did not check the X.500 name of any certificate, subject, or issuer being passed in for LDAP wild cards, meaning the presence of a wild car may lead to Information Disclosure. A potential attack would be to generate a self-signed certificate with a subject name that contains special characters, e.g: `CN=Subject*)(objectclass=`. This will be included into the filter and provides the attacker ability to specify additional attributes in the search query. This can be exploited as a blind LDAP injection: an attacker can enumerate valid attribute values using the boolean blind injection technique. The exploitation depends on the structure of the target LDAP directory, as well as what kind of errors are exposed to the user. Changes to the `X509LDAPCertStoreSpi.java` class add the additional checking of any X.500 name used to correctly escape wild card characters.

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-08-01T13:41:35.587145+00:00	GHSA Importer	Affected by	VCID-f8vc-nspc-qyfj	https://github.com/advisories/GHSA-hr8g-6v94-x4m9	37.0.0
2025-08-01T11:26:22.670641+00:00	GitLab Importer	Affected by	VCID-d6h1-yem6-qkhh	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.bouncycastle/bcprov-ext-jdk15on/CVE-2023-33202.yml	37.0.0
2025-07-31T09:29:27.945724+00:00	GitLab Importer	Affected by	VCID-f8vc-nspc-qyfj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.bouncycastle/bcprov-ext-jdk15on/CVE-2023-33201.yml	37.0.0