DNS Poisoning

2024-05-0606:27:58

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

ssl/tls

hostname verification

bouncy castle

java

cryptography

dns poisoning

AI Score

6.7

Confidence

High

EPSS

Percentile

15.5%

JSON

Bouncy Castle Java Cryptography APIs are vulnerable to improper SSL/TLS hostname verification. The vulnerability is due to hostname verification potentially being performed against a DNS-resolved IP address when no explicit hostname is provided, which could lead to DNS poisoning risks.

Affected configurations

Vulners

Node

veracodebouncy_castle_jsse_provider_and_tls\/dtls_apiRange1.77–1.77

veracodebouncy_castle_providerRange1.77–1.77

veracodebouncy_castle_jsse_provider_and_tls\/dtls_apiRange1.77–1.77

veracodebouncy_castle_providerRange1.77–1.77

VendorProductVersionCPE
veracodebouncy_castle_jsse_provider_and_tls\/dtls_api*cpe:2.3:a:veracode:bouncy_castle_jsse_provider_and_tls\/dtls_api:*:*:*:*:*:*:*:*
veracodebouncy_castle_provider*cpe:2.3:a:veracode:bouncy_castle_provider:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
veracode	bouncy_castle_jsse_provider_and_tls\/dtls_api	*	cpe:2.3:a:veracode:bouncy_castle_jsse_provider_and_tls\/dtls_api::::::::
veracode	bouncy_castle_provider	*	cpe:2.3:a:veracode:bouncy_castle_provider::::::::