CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-33202 – bc-java: Out of memory while parsing ASN.1 crafted data in org.bouncycastle.openssl.PEMParser class
https://notcve.org/view.php?id=CVE-2023-33202
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack. (For users of the FIPS Java API: BC-FJA 1.0.2.3 and earlier are affected; BC-FJA 1.0.2.4 is fixed.) Bouncy Castle para Java anterior a 1.73 contiene un posible problema de denegación de servicio (DoS) dentro de la clase Bouncy Castle org.bouncycastle.openssl.PEMParser. • https://bouncycastle.org https://github.com/bcgit/bc-java/wiki/CVE-2023-33202 https://security.netapp.com/advisory/ntap-20240125-0001 https://access.redhat.com/security/cve/CVE-2023-33202 https://bugzilla.redhat.com/show_bug.cgi?id=2251281 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-33201 – bouncycastle: potential blind LDAP injection attack using a self-signed certificate
https://notcve.org/view.php?id=CVE-2023-33201
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability. A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. • https://bouncycastle.org https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc https://github.com/bcgit/bc-java/wiki/CVE-2023-33201 https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html https://security.netapp.com/advisory/ntap-20230824-0008 https://access.redhat.com/security/cve/CVE-2023-33201 https://bugzilla.redhat.com/show_bug.cgi?id=2215465 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-295: Improper Certificate Validation •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2022-45146
https://notcve.org/view.php?id=CVE-2022-45146
An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11. Se descubrió un problema en la API FIPS Java de Bouncy Castle BC-FJA antes de la versión 1.0.2.4. Los cambios en el recolector de basura JVM en Java 13 y versiones posteriores desencadenan un problema en los módulos BC-FJA FIPS donde es posible que las claves temporales utilizadas por el módulo se pongan a cero mientras el módulo aún las usa, lo que genera errores o información potencial. pérdida. • https://github.com/bcgit/bc-java/wiki/CVE-2022-45146 https://mvnrepository.com/artifact/org.bouncycastle/bc-fips https://www.bouncycastle.org/latest_releases.html • CWE-416: Use After Free •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0CVE-2020-15522 – bouncycastle: Timing issue within the EC math library
https://notcve.org/view.php?id=CVE-2020-15522
Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures. Bouncy Castle BC Java versiones anteriores a 1.66, BC C # .NET versiones anteriores a 1.8.7, BC-FJA versiones anteriores a 1.0.1.2, 1.0.2.1 y BC-FNA versiones anteriores a 1.0.1.1, presentan un problema de sincronización dentro de la biblioteca EC math que puede exponer información sobre la clave privada cuando un atacante es capaz de observar información de sincronización para la generación de múltiples firmas ECDSA deterministas A flaw was found in bouncycastle. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures. • https://github.com/bcgit/bc-csharp/wiki/CVE-2020-15522 https://github.com/bcgit/bc-java/wiki/CVE-2020-15522 https://security.netapp.com/advisory/ntap-20210622-0007 https://www.bouncycastle.org/releasenotes.html https://access.redhat.com/security/cve/CVE-2020-15522 https://bugzilla.redhat.com/show_bug.cgi?id=1962879 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 8.1EPSS: 0%CPEs: 39EXPL: 1CVE-2020-28052 – bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible
https://notcve.org/view.php?id=CVE-2020-28052
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. Se detectó un problema en Legion of the Bouncy Castle BC Java versiones 1.65 y 1.66. El método de la utilidad OpenBSDBCrypt.checkPassword comparó datos incorrectos al comprobar la contraseña, permitiendo a unas contraseñas incorrectas indicar que coinciden con otras previamente en hash que eran diferentes A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. • https://github.com/bcgit/bc-java/wiki/CVE-2020-28052 https://lists.apache.org/thread.html/r167dbc42ef7c59802c2ca1ac14735ef9cf687c25208229993d6206fe%40%3Cissues.karaf.apache.org%3E https://lists.apache.org/thread.html/r175f5a25d100dbe2b1bd3459b3ce882a84c3ff91b120ed4ff2d57b53%40%3Ccommits.pulsar.apache.org%3E https://lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4a%40%3Ccommits.druid.apache.org%3E https://lists.apache.org/thread.html/r2ddabd06d94b60cfb0141e4abb23201c628ab925e30742f61a04d013%40%3Cissues.karaf.apache.org%3E https://list • CWE-287: Improper Authentication •