GHSA-wg6q-6289-32hp
Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.bouncycastle:bcpkix-jdk18on | >= 1.49, < 1.84 | 1.84 |
| Maven | org.bouncycastle:bcpkix-jdk15to18 | >= 1.49, < 1.84 | 1.84 |
| Maven | org.bouncycastle:bcpkix-jdk15on | >= 1.49, < 1.84 | 1.84 |
| Maven | org.bouncycastle:bcpkix-jdk14 | >= 1.49, < 1.84 | 1.84 |
| Maven | org.bouncycastle:bcpkix-debug-jdk18on | >= 1.49, < 1.84 | 1.84 |
| Maven | org.bouncycastle:bcpkix-debug-jdk15to18 | >= 1.49, < 1.84 | 1.84 |
| Maven | org.bouncycastle:bcpkix-debug-jdk14 | >= 1.49, < 1.84 | 1.84 |
Details
As written in the advisory (Markdown source, shown as plain text).
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).
PKIX draft CompositeVerifier accepts empty signature sequence as valid.
This issue affects BC-JAVA: from 1.49 before 1.84.
References
External links from the advisory. They lead to third-party sites.