Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-3E0EF0617FCD6A83E344CBF468D4BF88Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
Low
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.
References
github.com/advisories/GHSA-8xfc-gm6g-vgpv
github.com/bcgit/bc-csharp/commit/56daa6eac526f165416d17f661422d60de0dfd63
github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9029857
github.com/bcgit/bc-java/commit/fee80dd230e7fba132d03a34f1dd1d6aae0d0281
github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9029857
nvd.nist.gov/vuln/detail/CVE-2024-29857
www.bouncycastle.org/latest_releases.html
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
Low