GitHub Advisoryadvisory · Maven, NuGet

GHSA-8xfc-gm6g-vgpv Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

MEDIUM Published 2024-05-14 Modified 2024-12-06 Official page ↗
Aliases
CVE-2024-29857
Ecosystem
Maven, NuGet
Packages
org.bouncycastle:bcprov-jdk18on, org.bouncycastle:bcprov-jdk15on, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk14, org.bouncycastle:bctls-jdk18on, org.bouncycastle:bctls-jdk14, org.bouncycastle:bctls-jdk15to18, org.bouncycastle:bc-fips, BouncyCastle, BouncyCastle.Cryptography
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-125, CWE-400
Reviewed
2024-05-14

Affected packages

• Maven org.bouncycastle:bcprov-jdk18on: < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bcprov-jdk15on: < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bcprov-jdk15to18: < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bcprov-jdk14: < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bctls-jdk18on: < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bctls-jdk14: < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bctls-jdk15to18: < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bc-fips: < 1.0.2.5 → fixed in 1.0.2.5 • NuGet BouncyCastle: < 2.3.1 (no fix yet) • NuGet BouncyCastle.Cryptography: < 2.3.1 → fixed in 2.3.1

Description

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Related

Alias · CVE (1)

  • CVE-2024-29857 An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA… vulnerability

Weakness · CWE (2)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References