Search for packages
| purl | pkg:maven/org.bouncycastle/bcprov-jdk15to18@1.67 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5aet-5u76-sugd
Aliases: CVE-2025-8885 GHSA-67mf-3cr5-8w23 |
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java. This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0. |
Affected by 0 other vulnerabilities. |
|
VCID-d6h1-yem6-qkhh
Aliases: CVE-2023-33202 GHSA-wjxj-5m7g-mg7q |
Bouncy Castle Denial of Service (DoS) Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. |
Affected by 6 other vulnerabilities. |
|
VCID-dmsp-kyt4-fbfx
Aliases: CVE-2024-34447 GHSA-4h8f-2wvx-gg5w |
Bouncy Castle Java Cryptography API vulnerable to DNS poisoning An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning. |
Affected by 0 other vulnerabilities. |
|
VCID-f8vc-nspc-qyfj
Aliases: CVE-2023-33201 GHSA-hr8g-6v94-x4m9 |
Bouncy Castle For Java LDAP injection vulnerability Bouncy Castle provides the `X509LDAPCertStoreSpi.java` class which can be used in conjunction with the CertPath API for validating certificate paths. Pre-1.73 the implementation did not check the X.500 name of any certificate, subject, or issuer being passed in for LDAP wild cards, meaning the presence of a wild car may lead to Information Disclosure. A potential attack would be to generate a self-signed certificate with a subject name that contains special characters, e.g: `CN=Subject*)(objectclass=`. This will be included into the filter and provides the attacker ability to specify additional attributes in the search query. This can be exploited as a blind LDAP injection: an attacker can enumerate valid attribute values using the boolean blind injection technique. The exploitation depends on the structure of the target LDAP directory, as well as what kind of errors are exposed to the user. Changes to the `X509LDAPCertStoreSpi.java` class add the additional checking of any X.500 name used to correctly escape wild card characters. |
Affected by 5 other vulnerabilities. |
|
VCID-gr1b-m4u1-z7a3
Aliases: CVE-2024-29857 GHSA-8xfc-gm6g-vgpv |
Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters. |
Affected by 0 other vulnerabilities. |
|
VCID-t3ap-b4c1-byfr
Aliases: CVE-2024-30171 GHSA-v435-xc8x-wvr9 |
Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-v1s3-htdk-v7ep | Logic error in Legion of the Bouncy Castle BC Java An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. |
CVE-2020-28052
GHSA-73xv-w5gp-frxh |