VDB
Sign up
HIGH7.5

GHSA-qp49-qgx5-5m26

Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

Quick fix

GHSA-qp49-qgx5-5m26 — org.bouncycastle:bcprov-jdk18on: upgrade to the fixed version with the command below.

# pom.xml: bump <version>1.85</version> for org.bouncycastle:bcprov-jdk18on

Details

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.bouncycastle:bcprov-jdk18on
Introduced in: 0Fixed in: 1.85
Fix# pom.xml: bump <version>1.85</version> for org.bouncycastle:bcprov-jdk18on
Maven/org.bouncycastle:bc-fips
Introduced in: 0Fixed in: 1.0.2.7
Fix# pom.xml: bump <version>1.0.2.7</version> for org.bouncycastle:bc-fips
Maven/org.bouncycastle:bc-fips
Introduced in: 2.0.0Fixed in: 2.0.2
Fix# pom.xml: bump <version>2.0.2</version> for org.bouncycastle:bc-fips
Maven/org.bouncycastle:bc-fips
Introduced in: 2.1.0Fixed in: 2.1.3
Fix# pom.xml: bump <version>2.1.3</version> for org.bouncycastle:bc-fips
Maven/org.bouncycastle:bcprov-lts8on
Introduced in: 0Fixed in: 2.73.12
Fix# pom.xml: bump <version>2.73.12</version> for org.bouncycastle:bcprov-lts8on
Maven/org.bouncycastle:bcprov-jdk15to18
Introduced in: 0Fixed in: 1.85
Fix# pom.xml: bump <version>1.85</version> for org.bouncycastle:bcprov-jdk15to18

References