Debian Security Bug TrackerDEBIANCVE:CVE-2024-34447

HistoryMay 03, 2024 - 4:15 p.m.

CVE-2024-34447

2024-05-0316:15:11

Debian Security Bug Tracker

security-tracker.debian.org

bouncy castle

java cryptography

dns poisoning

ssl sockets

dns verification

ssl endpoint

AI Score

Confidence

Low

EPSS

Percentile

15.5%

JSON

An issue was discovered in Bouncy Castle Java Cryptography APIs before BC 1.78. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

OSVersionArchitecturePackageVersionFilename
Debian12allbouncycastle<= 1.72-2bouncycastle_1.72-2_all.deb
Debian11allbouncycastle<= 1.68-2bouncycastle_1.68-2_all.deb
Debian999allbouncycastle<= 1.77-1bouncycastle_1.77-1_all.deb
Debian13allbouncycastle<= 1.77-1bouncycastle_1.77-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	bouncycastle	<= 1.72-2	bouncycastle_1.72-2_all.deb
Debian	11	all	bouncycastle	<= 1.68-2	bouncycastle_1.68-2_all.deb
Debian	999	all	bouncycastle	<= 1.77-1	bouncycastle_1.77-1_all.deb
Debian	13	all	bouncycastle	<= 1.77-1	bouncycastle_1.77-1_all.deb