~ / search / GHSA-2mh8-gx2m-mr75

GHSA-2mh8-gx2m-mr75

Out-of-Memory Error in Bouncy Castle Crypto

Source: GitHub Advisory Database (reviewed) High CVE-2019-17359

Packages

EcosystemPackageAffectedFixed in
Maven org.bouncycastle:bcprov-jdk14 >= 1.63, < 1.64 1.64

Details

As written in the advisory (Markdown source, shown as plain text).

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

References

External links from the advisory. They lead to third-party sites.