Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-WJXJ-5M7G-MG7Q
HistoryNov 23, 2023 - 6:30 p.m.

Bouncy Castle Denial of Service (DoS)

2023-11-2318:30:33
CWE-400
GitHub Advisory Database
github.com
31
bouncy castle
java
dos
vulnerability
pemparser
outofmemoryerror

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.8%

JSON

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.

Affected configurations

Vulners
Node
org.bouncycastle\bcprovMatchjdk15on
OR
org.bouncycastle\bcprovMatchjdk16
OR
org.bouncycastle\bcprovMatchjdk15to18
OR
org.bouncycastle\bcprovMatchjdk15
OR
org.bouncycastle\bcprovMatchjdk14
OR
org.bouncycastle\bcprovMatchjdk16
OR
org.bouncycastle\bcprovMatchjdk15on
OR
org.bouncycastle\bcpkixMatchjdk18on
OR
org.bouncycastle\bcprovMatchjdk18on

Related

cvelist 1
debiancve 1
osv 2
veracode 1
cgr 1
wolfi 1
ubuntucve 1
nvd 1
redhatcve 1
ibm 8
nessus 2
prion 1
cve 1
redhat 1
oracle 1
cvelist
cvelist
CVE-2023-33202
2023-11-23 00:00:00
debiancve
debiancve
CVE-2023-33202
2023-11-23 16:15:07
osv
osv
CVE-2023-33202
2023-11-23 16:15:07
Bouncy Castle Denial of Service (DoS)
2023-11-23 18:30:33
veracode
veracode
Denial Of Service (DoS)
2023-11-27 07:58:36
cgr
cgr
CVE-2023-33202 vulnerabilities
2024-05-19 03:07:16
wolfi
wolfi
CVE-2023-33202 vulnerabilities
2024-06-26 09:08:30
ubuntucve
ubuntucve
CVE-2023-33202
2023-11-23 00:00:00
nvd
nvd
CVE-2023-33202
2023-11-23 16:15:07
redhatcve
redhatcve
CVE-2023-33202
2023-11-23 20:49:53
ibm
ibm
Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to a denial of service CVE-2023-33202
2024-03-13 14:28:21
Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Bouncy Castle Crypto Package for Java
2024-03-20 00:44:30
Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands may be vulnerable to denial of service
2024-03-28 11:20:52
nessus
nessus
Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2024-479)
2024-01-08 00:00:00
Oracle WebLogic Server (April 2024 CPU)
2024-04-17 00:00:00
prion
prion
Design/Logic Flaw
2023-11-23 16:15:00
cve
cve
CVE-2023-33202
2023-11-23 16:15:07
redhat
redhat
(RHSA-2024:3527) Moderate: Red Hat AMQ Streams 2.7.0 release and security update
2024-05-30 20:22:55
oracle
oracle
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.8%

JSON
Related for GHSA-WJXJ-5M7G-MG7Q
cvelist1debiancve1osv2veracode1cgr1wolfi1ubuntucve1nvd1redhatcve1ibm8nessus2prion1cve1redhat1oracle1