HIGH7.5
GHSA-qp49-qgx5-5m26
Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard
Quick fix
GHSA-qp49-qgx5-5m26 — org.bouncycastle:bcprov-jdk18on: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1.85</version> for org.bouncycastle:bcprov-jdk18onDetails
In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.bouncycastle:bcprov-jdk18on
Introduced in:
0Fixed in: 1.85Fix
# pom.xml: bump <version>1.85</version> for org.bouncycastle:bcprov-jdk18onMaven/org.bouncycastle:bc-fips
Introduced in:
0Fixed in: 1.0.2.7Fix
# pom.xml: bump <version>1.0.2.7</version> for org.bouncycastle:bc-fipsMaven/org.bouncycastle:bc-fips
Introduced in:
2.0.0Fixed in: 2.0.2Fix
# pom.xml: bump <version>2.0.2</version> for org.bouncycastle:bc-fipsMaven/org.bouncycastle:bc-fips
Introduced in:
2.1.0Fixed in: 2.1.3Fix
# pom.xml: bump <version>2.1.3</version> for org.bouncycastle:bc-fipsMaven/org.bouncycastle:bcprov-lts8on
Introduced in:
0Fixed in: 2.73.12Fix
# pom.xml: bump <version>2.73.12</version> for org.bouncycastle:bcprov-lts8onMaven/org.bouncycastle:bcprov-jdk15to18
Introduced in:
0Fixed in: 1.85Fix
# pom.xml: bump <version>1.85</version> for org.bouncycastle:bcprov-jdk15to18