PT-2023-7206 · Bc-Fja+2 · Bc-Fja+2
CVE-2023-33202
·
Publicado
2023-11-23
·
Atualizado
2025-08-18
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Bouncy Castle for Java versions prior to 1.73
BC-FJA versions prior to 1.0.2.4
Description
The issue is related to insufficient input validation in the Bouncy Castle org.bouncycastle.openssl.PEMParser class, which parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. An attacker can exploit this by crafting ASN.1 data, causing an OutOfMemoryError that enables a denial of service attack.
Recommendations
For Bouncy Castle for Java versions prior to 1.73, update to version 1.73 or later to resolve the issue.
For BC-FJA versions prior to 1.0.2.4, update to version 1.0.2.4 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the
org.bouncycastle.openssl.PEMParser class until a patch is available.Exploit
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Bc-Fja
Bouncy Castle For Java
Debian