VDB
Sign up
MEDIUM5.9

GHSA-4h8f-2wvx-gg5w

Bouncy Castle Java Cryptography API vulnerable to DNS poisoning

Quick fix

GHSA-4h8f-2wvx-gg5w — org.bouncycastle:bcprov-jdk18on: upgrade to the fixed version with the command below.

# pom.xml: bump <version>1.78</version> for org.bouncycastle:bcprov-jdk18on

Details

An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.bouncycastle:bcprov-jdk18on
Introduced in: 1.61Fixed in: 1.78
Fix# pom.xml: bump <version>1.78</version> for org.bouncycastle:bcprov-jdk18on
Maven/org.bouncycastle:bcprov-jdk15to18
Introduced in: 1.61Fixed in: 1.78
Fix# pom.xml: bump <version>1.78</version> for org.bouncycastle:bcprov-jdk15to18
Maven/org.bouncycastle:bcprov-jdk14
Introduced in: 1.61Fixed in: 1.78
Fix# pom.xml: bump <version>1.78</version> for org.bouncycastle:bcprov-jdk14
Maven/org.bouncycastle:bcprov-jdk12
Introduced in: 1.61Fixed in: 1.78
Fix# pom.xml: bump <version>1.78</version> for org.bouncycastle:bcprov-jdk12
Maven/org.bouncycastle:bctls-fips
Introduced in: 0Fixed in: 1.0.19
Fix# pom.xml: bump <version>1.0.19</version> for org.bouncycastle:bctls-fips
Maven/org.bouncycastle:bcprov-lts8on
Introduced in: 0Fixed in: 2.73.6
Fix# pom.xml: bump <version>2.73.6</version> for org.bouncycastle:bcprov-lts8on
Maven/org.bouncycastle:bcprov-jdk15on
Introduced in: 1.61Fixed in: 1.78
Fix# pom.xml: bump <version>1.78</version> for org.bouncycastle:bcprov-jdk15on

References