~ / search / GHSA-8xfc-gm6g-vgpv

GHSA-8xfc-gm6g-vgpv

Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-29857

Packages

EcosystemPackageAffectedFixed in
Maven org.bouncycastle:bcprov-jdk18on < 1.78 1.78
Maven org.bouncycastle:bcprov-jdk15on < 1.78 1.78
Maven org.bouncycastle:bcprov-jdk15to18 < 1.78 1.78
Maven org.bouncycastle:bcprov-jdk14 < 1.78 1.78
Maven org.bouncycastle:bctls-jdk18on < 1.78 1.78
Maven org.bouncycastle:bctls-jdk14 < 1.78 1.78
Maven org.bouncycastle:bctls-jdk15to18 < 1.78 1.78
Maven org.bouncycastle:bc-fips < 1.0.2.5 1.0.2.5
NuGet BouncyCastle < 2.3.1 no fix listed
NuGet BouncyCastle.Cryptography < 2.3.1 2.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

References

External links from the advisory. They lead to third-party sites.