GitHub Advisoryadvisory · Maven, NuGet

GHSA-m44j-cfrm-g8qc Bouncy Castle crafted signature and public key can be used to trigger an infinite loop

MEDIUM Published 2024-05-14 Modified 2024-12-02 Official page ↗
Aliases
CVE-2024-30172
Ecosystem
Maven, NuGet
Packages
org.bouncycastle:bcprov-jdk18on, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk14, org.bouncycastle:bctls-jdk18on, org.bouncycastle:bctls-jdk14, org.bouncycastle:bctls-jdk15to18, BouncyCastle, BouncyCastle.Cryptography
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-835
Reviewed
2024-05-14

Affected packages

• Maven org.bouncycastle:bcprov-jdk18on: >= 1.73, < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bcprov-jdk15to18: >= 1.73, < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bcprov-jdk14: >= 1.73, < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bctls-jdk18on: >= 1.73, < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bctls-jdk14: >= 1.73, < 1.78 → fixed in 1.78 • Maven org.bouncycastle:bctls-jdk15to18: >= 1.73, < 1.78 → fixed in 1.78 • NuGet BouncyCastle: < 2.3.1 (no fix yet) • NuGet BouncyCastle.Cryptography: < 2.3.1 → fixed in 2.3.1

Description

An issue was discovered in Bouncy Castle Java Cryptography APIs starting in 1.73 and before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

Related

Alias · CVE (1)

  • CVE-2024-30172 An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References