Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-06FE75F40EB960E4F1144116AF981F22Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.
References
github.com/advisories/GHSA-8xfc-gm6g-vgpv
github.com/bcgit/bc-csharp/commit/56daa6eac526f165416d17f661422d60de0dfd63
github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9029857
github.com/bcgit/bc-java/commit/fee80dd230e7fba132d03a34f1dd1d6aae0d0281
github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9029857
nvd.nist.gov/vuln/detail/CVE-2024-29857
www.bouncycastle.org/latest_releases.html
Related
6.2 Medium
AI Score
Confidence
Low
0 Low
EPSS
Percentile
0.0%