PT-2024-25901 · Unknown+3 · Bouncy Castle Java Cryptography Api+3

David Hook · Published 2024-05-03 · Updated 2026-03-18 · CVE-2024-34447

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Bouncy Castle Java Cryptography APIs versions prior to 1.78

Description An issue was discovered in the Bouncy Castle Java Cryptography APIs. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname, hostname verification could be performed against a DNS-resolved IP address in some situations. This opens up a possibility of DNS poisoning.

Recommendations For versions prior to 1.78, update to version 1.78 or later to resolve the issue. As a temporary workaround, consider disabling endpoint identification in the BCJSSE to minimize the risk of exploitation. Restrict access to SSL sockets created without an explicit hostname to prevent potential DNS poisoning attacks.

Exploit

Fix

Weakness Enumeration

CWE-297

Related Identifiers

CVE-2024-34447

GHSA-4H8F-2WVX-GG5W

USN-8108-1

Affected Products

Bouncy Castle Java Cryptography Api

Debian

Linuxmint

Ubuntu

References · 23

• 🔥 https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447 · Exploit
• https://cve.org/CVERecord?id=CVE-2024-34447 · Security Note
• https://osv.dev/vulnerability/GHSA-4h8f-2wvx-gg5w · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8916 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29857 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-34447 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34447 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8108-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-30171 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-34447 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-34447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34447 · Security Note
• https://ubuntu.com/security/CVE-2024-30172 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8108-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-33201 · Vendor Advisory