Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

2024-05-1415:32:54

CWE-400

GitHub Advisory Database

github.com

bouncy castle

certificate parsing

high cpu usage

ec certificate

crafted f2m parameters

software vulnerability

6.7 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Affected configurations

Vulners

Node

bouncycastle.cryptographyRange<2.3.1

nugetbouncycastleRange<2.3.1

org.bouncycastle\bcMatchfips

org.bouncycastle\bcpkixMatchjdk14

org.bouncycastle\bcpkixMatchjdk15to18

org.bouncycastle\bcpkixMatchjdk18on

org.bouncycastle\bctlsMatchjdk15to18

org.bouncycastle\bctlsMatchjdk14

org.bouncycastle\bctlsMatchjdk18on

org.bouncycastle\bcprovMatchjdk14

org.bouncycastle\bcprovMatchjdk15to18

org.bouncycastle\bcprovMatchjdk15on

org.bouncycastle\bcprovMatchjdk18on

CPENameOperatorVersion
bouncycastle.cryptographylt2.3.1
bouncycastlelt2.3.1
org.bouncycastle:bc-fipslt1.0.2.5
org.bouncycastle:bcpkix-jdk14lt1.78
org.bouncycastle:bcpkix-jdk15to18lt1.78
org.bouncycastle:bcpkix-jdk18onlt1.78
org.bouncycastle:bctls-jdk15to18lt1.78
org.bouncycastle:bctls-jdk14lt1.78
org.bouncycastle:bctls-jdk18onlt1.78
org.bouncycastle:bcprov-jdk14lt1.78

Name	Operator	Version
bouncycastle.cryptography	lt	2.3.1
bouncycastle	lt	2.3.1
org.bouncycastle:bc-fips	lt	1.0.2.5
org.bouncycastle:bcpkix-jdk14	lt	1.78
org.bouncycastle:bcpkix-jdk15to18	lt	1.78
org.bouncycastle:bcpkix-jdk18on	lt	1.78
org.bouncycastle:bctls-jdk15to18	lt	1.78
org.bouncycastle:bctls-jdk14	lt	1.78
org.bouncycastle:bctls-jdk18on	lt	1.78
org.bouncycastle:bcprov-jdk14	lt	1.78