Fluid Attacks Database

Description

Bouncy Castle crafted signature and public key can be used to trigger an infinite loop An issue was discovered in Bouncy Castle Java Cryptography APIs starting in 1.73 and before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.bouncycastle:bcprov-jdk15to18	>=1.73 <1.78	1.78
maven	org.bouncycastle:bctls-jdk18on	>=1.73 <1.78	1.78
maven	org.bouncycastle:bctls-jdk14	>=1.73 <1.78	1.78
nuget	bouncycastle	>=0 <2.3.1	-
maven	org.bouncycastle:bcprov-jdk14	>=1.73 <1.78	1.78
maven	org.bouncycastle:bcprov-jdk18on	>=1.73 <1.78	1.78
nuget	bouncycastle.cryptography	>=0 <2.3.1	2.3.1
debian 12	bouncycastle	=1.72-2 \|\| =1.77-1 \|\| =1.80-1 \|\| =1.80-2 \|\| =1.80-3	-
debian 13	bouncycastle	>=0 <1.80-1	1.80-1
debian 14	bouncycastle	>=0 <1.80-1	1.80-1

1-10 of 15

Aliases

1. CVE-2024-301722. NVD-2024-301723. OSV-2024-301724. OSV-DEBIAN-2024-301725. GHSA-m44j-cfrm-g8qc6. GCVE-2024-301727. SECURITY-TRACKER-CVE-2024-30172

References

1. https://github.com/bcgit/bc-java/commit/1b9fd9b545e691bfb3941a9f6a797660c8860f022. https://github.com/bcgit/bc-java/commit/9c165791b68a204678b48ec11e4e579754c2ea493. https://github.com/bcgit/bc-java/commit/ebe1c75579170072dc59b8dee2b55ce31663178f4. https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%90301725. https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%90301726. https://security.netapp.com/advisory/ntap-20240614-00077. https://www.bouncycastle.org/latest_releases.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.