VDB
Sign up
MEDIUM

GHSA-4cx2-fc23-5wg6

Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

Quick fix

GHSA-4cx2-fc23-5wg6 — org.bouncycastle:bcpkix-jdk15on: upgrade to the fixed version with the command below.

# pom.xml: bump <version>1.79</version> for org.bouncycastle:bcpkix-jdk15on

Details

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java , https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .

This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.bouncycastle:bcpkix-jdk15on
Introduced in: 1.44Fixed in: 1.79
Fix# pom.xml: bump <version>1.79</version> for org.bouncycastle:bcpkix-jdk15on
Maven/org.bouncycastle:bcpkix-jdk15to18
Introduced in: 1.44Fixed in: 1.79
Fix# pom.xml: bump <version>1.79</version> for org.bouncycastle:bcpkix-jdk15to18
Maven/org.bouncycastle:bcpkix-jdk18on
Introduced in: 1.44Fixed in: 1.79
Fix# pom.xml: bump <version>1.79</version> for org.bouncycastle:bcpkix-jdk18on
Maven/org.bouncycastle:bcpkix-fips
Introduced in: 1.0.0Fixed in: 1.0.8
Fix# pom.xml: bump <version>1.0.8</version> for org.bouncycastle:bcpkix-fips
Maven/org.bouncycastle:bcpkix-fips
Introduced in: 2.0.0Fixed in: 2.0.8
Fix# pom.xml: bump <version>2.0.8</version> for org.bouncycastle:bcpkix-fips

References