Fluid Attacks Database

Description

Bouncy Castle Denial of Service (DoS) Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	bouncycastle	=1.68-2 \|\| =1.68-3 \|\| =1.68-4 \|\| =1.68-5 \|\| =1.69-1 \|\| =1.71-1 \|\| =1.72-1 \|\| =1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3	-
maven	org.bouncycastle:bcpkix-jdk15to18	>=0 <1.73	1.73
maven	org.bouncycastle:bcprov-jdk15on	>=0 <1.70	1.70
maven	org.bouncycastle:bcprov-jdk14	>=0 <1.73	1.73
maven	org.bouncycastle:bcprov-jdk15	>=0 <1.73	1.73
maven	org.bouncycastle:bcprov-jdk16	>=0 <1.73	1.73
maven	org.bouncycastle:bcprov-ext-jdk15on	>=0 <1.73	1.73
maven	org.bouncycastle:bcprov-ext-jdk16	>=0 <1.73	1.73
maven	org.bouncycastle:bcprov-jdk15to18	>=0 <1.73	1.73
maven	org.bouncycastle:bcprov-jdk18on	>=0 <1.73	1.73

1-10 of 16

Aliases

1. CVE-2023-332022. NVD-2023-332023. OSV-DEBIAN-2023-332024. OSV-2023-332025. GCVE-2023-332026. SECURITY-TRACKER-CVE-2023-332027. https://github.com/bcgit/bc-java/wiki/CVE-2023-33202

References

1. https://bouncycastle.org2. https://github.com/bcgit/bc-java/commit/0c576892862ed41894f49a8f639112e8d66d229c3. https://github.com/bcgit/bc-java/wiki/CVE-2023-332024. https://security.netapp.com/advisory/ntap-20240125-0001

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.