Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

2024-05-1415:32:54

CWE-400

GitHub Advisory Database

github.com

bouncy castle

certificate parsing

high cpu usage

ec certificate

crafted f2m parameters

software vulnerability

6.7 Medium

AI Score

Confidence

High

JSON

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

CPENameOperatorVersion
bouncycastle.cryptographylt2.3.1
bouncycastlelt2.3.1
org.bouncycastle:bc-fipslt1.0.2.5
org.bouncycastle:bcpkix-jdk14lt1.78
org.bouncycastle:bcpkix-jdk15to18lt1.78
org.bouncycastle:bcpkix-jdk18onlt1.78
org.bouncycastle:bctls-jdk15to18lt1.78
org.bouncycastle:bctls-jdk14lt1.78
org.bouncycastle:bctls-jdk18onlt1.78
org.bouncycastle:bcprov-jdk14lt1.78

Name	Operator	Version
bouncycastle.cryptography	lt	2.3.1
bouncycastle	lt	2.3.1
org.bouncycastle:bc-fips	lt	1.0.2.5
org.bouncycastle:bcpkix-jdk14	lt	1.78
org.bouncycastle:bcpkix-jdk15to18	lt	1.78
org.bouncycastle:bcpkix-jdk18on	lt	1.78
org.bouncycastle:bctls-jdk15to18	lt	1.78
org.bouncycastle:bctls-jdk14	lt	1.78
org.bouncycastle:bctls-jdk18on	lt	1.78
org.bouncycastle:bcprov-jdk14	lt	1.78