GitHub Advisoryadvisory · Maven

GHSA-2mh8-gx2m-mr75 Out-of-Memory Error in Bouncy Castle Crypto

HIGH Published 2019-10-17 Modified 2022-10-07 Official page ↗
Aliases
CVE-2019-17359
Ecosystem
Maven
Packages
org.bouncycastle:bcprov-jdk14
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2019-10-17

Affected packages

• Maven org.bouncycastle:bcprov-jdk14: >= 1.63, < 1.64 → fixed in 1.64

Description

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

Related

Alias · CVE (1)

  • CVE-2019-17359 The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References