GHSA-hr8g-6v94-x4m9 CVE-2023-33201
Bouncy Castle For Java LDAP injection vulnerability
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.77%
- Chance of exploitation in the next 30 days. Higher than 55.71% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-295 Improper Certificate Validation
- Fix
- Available
- 9 packages have a fixed version
Description
Bouncy Castle provides the X509LDAPCertStoreSpi.java class which can be used in conjunction with the CertPath API for validating certificate paths. Pre-1.73 the implementation did not check the X.500 name of any certificate, subject, or issuer being passed in for LDAP wild cards, meaning the presence of a wild car may lead to Information Disclosure.
A potential attack would be to generate a self-signed certificate with a subject name that contains special characters, e.g: CN=Subject*)(objectclass=. This will be included into the filter and provides the attacker ability to specify additional attributes in the search query. This can be exploited as a blind LDAP injection: an attacker can enumerate valid attribute values using the boolean blind injection technique. The exploitation depends on the structure of the target LDAP directory, as well as what kind of errors are exposed to the user.
Changes to the X509LDAPCertStoreSpi.java class add the additional checking of any X.500 name used to correctly escape wild card characters.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.bouncycastle:bcprov-debug-jdk14 | >= 1.49, < 1.74 |
1.74 |
| org.bouncycastle:bcprov-debug-jdk15on | >= 1.49, <= 1.70 |
No fix yet |
| org.bouncycastle:bcprov-debug-jdk15to18 | < 1.74 |
1.74 |
| org.bouncycastle:bcprov-debug-jdk18on | < 1.74 |
1.74 |
| org.bouncycastle:bcprov-ext-jdk14 | >= 1.49, < 1.74 |
1.74 |
| org.bouncycastle:bcprov-ext-jdk15on | >= 1.49, <= 1.70 |
No fix yet |
| org.bouncycastle:bcprov-ext-jdk15to18 | < 1.74 |
1.74 |
| org.bouncycastle:bcprov-ext-jdk18on | < 1.74 |
1.74 |
| org.bouncycastle:bcprov-jdk14 | >= 1.49, < 1.74 |
1.74 |
| org.bouncycastle:bcprov-jdk15on | >= 1.49, <= 1.70 |
No fix yet |
| org.bouncycastle:bcprov-jdk15to18 | < 1.74 |
1.74 |
| org.bouncycastle:bcprov-jdk18on | < 1.74 |
1.74 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.bouncycastle:bcprov-debug-jdk14 Maven → 1.74
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-debug-jdk14</artifactId><version>1.74</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-debug-jdk14:1.74")
org.bouncycastle:bcprov-debug-jdk15to18 Maven → 1.74
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-debug-jdk15to18</artifactId><version>1.74</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-debug-jdk15to18:1.74")
org.bouncycastle:bcprov-debug-jdk18on Maven → 1.74
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-debug-jdk18on</artifactId><version>1.74</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-debug-jdk18on:1.74")
org.bouncycastle:bcprov-ext-jdk14 Maven → 1.74
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-ext-jdk14</artifactId><version>1.74</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-ext-jdk14:1.74")
org.bouncycastle:bcprov-ext-jdk15to18 Maven → 1.74
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-ext-jdk15to18</artifactId><version>1.74</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-ext-jdk15to18:1.74")
org.bouncycastle:bcprov-ext-jdk18on Maven → 1.74
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-ext-jdk18on</artifactId><version>1.74</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-ext-jdk18on:1.74")
org.bouncycastle:bcprov-jdk14 Maven → 1.74
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk14</artifactId><version>1.74</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk14:1.74")
org.bouncycastle:bcprov-jdk15to18 Maven → 1.74
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk15to18</artifactId><version>1.74</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk15to18:1.74")
org.bouncycastle:bcprov-jdk18on Maven → 1.74
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk18on</artifactId><version>1.74</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk18on:1.74")
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How to prevent it
- Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
References
Advisories
Packages
Other links
- github.com/bcgit/bc-java/commit/ccf93ca736b89250ff4ce079a5aa56f5cbf0ebbd
- github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc
- bouncycastle.org
- bouncycastle.org/releasenotes.html
- github.com/bcgit/bc-java/commits/main/prov/src/main/java/org/bouncycastle/jce/p…
- github.com/bcgit/bc-java/wiki/CVE-2023-33201
- lists.debian.org/debian-lts-announce/2023/08/msg00000.html
- security.netapp.com/advisory/ntap-20230824-0008
- security.netapp.com/advisory/ntap-20230824-0008
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-p93r-85wp-75v3 Bouncy Castle Has Covert Timing Channel Vulnerability | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-c3fc-8qff-9hwx Bouncy Castle has an LDAP injection | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-574f-3g2m-x479 Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks | High | Also affects org.bouncycastle:bcprov-debug-jdk14 |
| GHSA-67mf-3cr5-8w23 Bouncy Castle for Java on All (API modules) allows Excessive Allocation | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-m44j-cfrm-g8qc Bouncy Castle crafted signature and public key can be used to trigger an infinite loop | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-v435-xc8x-wvr9 Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-8xfc-gm6g-vgpv Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-4h8f-2wvx-gg5w Bouncy Castle Java Cryptography API vulnerable to DNS poisoning | High | Also affects org.bouncycastle:bcprov-jdk14 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor