Veracode Vulnerability DatabaseVERACODE:44384

HistoryNov 27, 2023 - 7:58 a.m.

Denial Of Service (DoS)

2023-11-2707:58:36

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

org.bouncycastle

bcprov

vulnerability

denial of service

parsing certificates

pemparser class

x.509 certificates

encoded keys

pkcs7 objects

outofmemoryerror

crafted asn.1 data

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.5%

JSON

org.bouncycastle: bcprov is vulnerable to Denial of Service (DoS). The vulnerability arises due to parsing certificates in the PEMParser class. This class is responsible for parsing X.509 certificates, encoded keys and PKCS7 objects. The parser can throw an OutOfMemoryError while parsing crafted ASN.1 data which can ultimately lead to a DoS.

CPENameOperatorVersion
bouncy castle providerle1.72
bouncy castle providerle1.70
bouncy castle providerle1.72
bouncy castle providerle1.70

Name	Operator	Version
bouncy castle provider	le	1.72
bouncy castle provider	le	1.70
bouncy castle provider	le	1.72
bouncy castle provider	le	1.70

References

bouncycastle.org

github.com/advisories/GHSA-wjxj-5m7g-mg7q

github.com/bcgit/bc-java/commit/eff6adf03f426dc4d55e8305255eb38c811ddda7

github.com/bcgit/bc-java/wiki/CVE-2023-33202

security.netapp.com/advisory/ntap-20240125-0001/