CVE-2024-29857
Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
Summary
Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
Original description
The description as published by the source.
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
org.bouncycastle:bcprov-jdk18on
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78"}]}]
Maven
org.bouncycastle:bcprov-jdk15on
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78"}]}]
Maven
org.bouncycastle:bcprov-jdk15to18
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78"}]}]
Maven
org.bouncycastle:bcprov-jdk14
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78"}]}]
Maven
org.bouncycastle:bctls-jdk18on
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78"}]}]
Maven
org.bouncycastle:bctls-jdk14
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78"}]}]
Maven
org.bouncycastle:bctls-jdk15to18
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78"}]}]
Maven
org.bouncycastle:bc-fips
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2.5"}]}]
NuGet
BouncyCastle
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
NuGet
BouncyCastle.Cryptography
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-29857 bouncycastle
References
- advisory nvd.nist.gov
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web security.netapp.com
- web bouncycastle.org