PT-2026-33031 · Bouncy Castle · Bcpkix Fips+1

Osidb Bzimport · CVE-2026-5588 · Publicado 2026-04-15 · Atualizado 2026-06-08

Positive Technologies (AI Summary) · Pt

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions BC-JAVA versões 1.49 até 1.83 BCPKIX-FIPS versões 2.0.6 até 2.0.10 BCPKIX-FIPS versões 2.1.7 até 2.1.10

Description O CompositeVerifier do rascunho PKIX aceita uma sequência de assinatura vazia como válida. Este problema está associado ao arquivo de programa JcaContentVerifierProviderBuilder.Java e envolve o uso de um algoritmo criptográfico quebrado ou arriscado nos módulos pkix.

Recommendations Atualize o BC-JAVA para a versão 1.84 ou posterior. Atualize as versões 2.0.6 até 2.0.10 do BCPKIX-FIPS para a versão 2.0.11 ou posterior. Atualize as versões 2.1.7 até 2.1.10 do BCPKIX-FIPS para a versão 2.1.11 ou posterior.

Exploit

Correção

Improper Verification of Cryptographic Signature

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-347

CWE-327

Identificadores relacionados

CLEANSTART-2026-AV84730

CLEANSTART-2026-DY69070

CLEANSTART-2026-GX01236

CLEANSTART-2026-IS05941

CLEANSTART-2026-JU62349

CLEANSTART-2026-KP10590

CLEANSTART-2026-PK73499

CLEANSTART-2026-PO27799

CLEANSTART-2026-RU36468

CLEANSTART-2026-SQ91016

CLEANSTART-2026-SR31778

CLEANSTART-2026-SV95049

CLEANSTART-2026-TK07726

CLEANSTART-2026-VJ37814

CLEANSTART-2026-VN28553

CLEANSTART-2026-WK99982

CVE-2026-5588

GHSA-WG6Q-6289-32HP

OPENSUSE-SU-2026:10571-1

OPENSUSE-SU-2026:20627-1

SUSE-SU-2026:1639-1

SUSE-SU-2026:21404-1

Produtos afetados

Bc-Java

Bcpkix Fips

Referências · 333

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%905588 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5588.json · Exploit
• https://github.com/bcgit/bc-java/commit/656bae0dbd9b1521f840521ff786e78749fe3057 · Correção
• https://github.com/bcgit/bc-java · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RU36468.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PO27799.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IS05941.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SQ91016.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VN28553.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GX01236.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KP10590.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VJ37814.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SR31778.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DY69070.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PK73499.json · Nota