Lucene search

GoogleOSV:GHSA-M44J-CFRM-G8QC

HistoryMay 14, 2024 - 3:32 p.m.

Bouncy Castle crafted signature and public key can be used to trigger an infinite loop

2024-05-1415:32:54

Google

osv.dev

bouncy castle

java cryptography

apis

ed25519

verification code

infinite loop

AI Score

6.6

Confidence

High

EPSS

Percentile

9.0%

JSON

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

References

github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030172

github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030172

nvd.nist.gov/vuln/detail/CVE-2024-30172

security.netapp.com/advisory/ntap-20240614-0007

www.bouncycastle.org/latest_releases.html