GHSA-4h8f-2wvx-gg5w CVE-2024-34447
Bouncy Castle Java Cryptography API vulnerable to DNS poisoning
- Severity
- 5.9 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.77%
- Chance of exploitation in the next 30 days. Higher than 55.66% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-297 Improper Validation of Certificate with Host Mismatch
- Fix
- Available
- 7 packages have a fixed version
Description
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.bouncycastle:bcprov-jdk12 | >= 1.61, < 1.78 |
1.78 |
| org.bouncycastle:bcprov-jdk14 | >= 1.61, < 1.78 |
1.78 |
| org.bouncycastle:bcprov-jdk15on | >= 1.61, < 1.78 |
1.78 |
| org.bouncycastle:bcprov-jdk15to18 | >= 1.61, < 1.78 |
1.78 |
| org.bouncycastle:bcprov-jdk18on | >= 1.61, < 1.78 |
1.78 |
| org.bouncycastle:bcprov-lts8on | < 2.73.6 |
2.73.6 |
| org.bouncycastle:bctls-fips | < 1.0.19 |
1.0.19 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.bouncycastle:bcprov-jdk12 Maven → 1.78
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk12</artifactId><version>1.78</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk12:1.78")
org.bouncycastle:bcprov-jdk14 Maven → 1.78
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk14</artifactId><version>1.78</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk14:1.78")
org.bouncycastle:bcprov-jdk15on Maven → 1.78
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk15on</artifactId><version>1.78</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk15on:1.78")
org.bouncycastle:bcprov-jdk15to18 Maven → 1.78
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk15to18</artifactId><version>1.78</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk15to18:1.78")
org.bouncycastle:bcprov-jdk18on Maven → 1.78
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk18on</artifactId><version>1.78</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk18on:1.78")
org.bouncycastle:bcprov-lts8on Maven → 2.73.6
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-lts8on</artifactId><version>2.73.6</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-lts8on:2.73.6")
org.bouncycastle:bctls-fips Maven → 1.0.19
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bctls-fips</artifactId><version>1.0.19</version></dependency>- gradle
implementation("org.bouncycastle:bctls-fips:1.0.19")
Severity breakdown
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-297: Improper Validation of Certificate with Host Mismatch
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
How to prevent it
- Architecture and Design: Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-p93r-85wp-75v3 Bouncy Castle Has Covert Timing Channel Vulnerability | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-c3fc-8qff-9hwx Bouncy Castle has an LDAP injection | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-574f-3g2m-x479 Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-67mf-3cr5-8w23 Bouncy Castle for Java on All (API modules) allows Excessive Allocation | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-m44j-cfrm-g8qc Bouncy Castle crafted signature and public key can be used to trigger an infinite loop | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-v435-xc8x-wvr9 Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-8xfc-gm6g-vgpv Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-wjxj-5m7g-mg7q Bouncy Castle Denial of Service (DoS) | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor