GitHub Advisoryadvisory · Maven

GHSA-wjxj-5m7g-mg7q Bouncy Castle Denial of Service (DoS)

MEDIUM Published 2023-11-23 Modified 2024-09-09 Official page ↗
Aliases
CVE-2023-33202
Ecosystem
Maven
Packages
org.bouncycastle:bcprov-ext-jdk16, org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk15, org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk16, org.bouncycastle:bcprov-jdk15on, org.bouncycastle:bcpkix-jdk18on, org.bouncycastle:bcprov-ext-jdk15on, org.bouncycastle:bcprov-jdk18on
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2023-11-24

Affected packages

• Maven org.bouncycastle:bcprov-ext-jdk16: < 1.73 → fixed in 1.73 • Maven org.bouncycastle:bcprov-jdk14: < 1.73 → fixed in 1.73 • Maven org.bouncycastle:bcprov-jdk15: < 1.73 → fixed in 1.73 • Maven org.bouncycastle:bcprov-jdk15to18: < 1.73 → fixed in 1.73 • Maven org.bouncycastle:bcprov-jdk16: < 1.73 → fixed in 1.73 • Maven org.bouncycastle:bcprov-jdk15on: < 1.70 (no fix yet) • Maven org.bouncycastle:bcpkix-jdk18on: < 1.73 → fixed in 1.73 • Maven org.bouncycastle:bcprov-ext-jdk15on: < 1.73 → fixed in 1.73 • Maven org.bouncycastle:bcprov-jdk18on: < 1.73 → fixed in 1.73

Description

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.

Related

Alias · CVE (1)

  • CVE-2023-33202 Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References