PT-2023-7206 · Unknown+2 · Bouncy Castle For Java+2

Published 2023-11-23 · Updated 2025-08-18 · CVE-2023-33202

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.73 BC-FJA versions prior to 1.0.2.4

Description The issue is related to insufficient input validation in the Bouncy Castle org.bouncycastle.openssl.PEMParser class, which parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. An attacker can exploit this by crafting ASN.1 data, causing an OutOfMemoryError that enables a denial of service attack.

Recommendations For Bouncy Castle for Java versions prior to 1.73, update to version 1.73 or later to resolve the issue. For BC-FJA versions prior to 1.0.2.4, update to version 1.0.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the org.bouncycastle.openssl.PEMParser class until a patch is available.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2023-08233

CVE-2023-33202

GHSA-WJXJ-5M7G-MG7Q

Affected Products

Bc-Fja

Bouncy Castle For Java

Debian

References · 24

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902023%E2%80%9033202 · Exploit
• 🔥 https://github.com/bcgit/bc-java/wiki/CVE-2023-33202 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2023-33202 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-33202 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-33202 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wjxj-5m7g-mg7q · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-33202 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-33202 · Security Note
• https://bdu.fstec.ru/vul/2023-08233 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33202 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-33202 · Vendor Advisory
• https://github.com/bcgit/bc-java · Note
• https://github.com/bcgit/bc-java/commit/0c576892862ed41894f49a8f639112e8d66d229c · Note
• https://t.me/cvenotify/62267 · Telegram Post
• https://access.redhat.com/security/cve/cve-2023-33202 · Note