Skip to content
OpenAdvisories
Medium ALAS2023-2023-280 1 CVE

Moderate: bouncycastle security update (Amazon Linux 2023)

Published Aug 3, 2023 · Updated Aug 9, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33201: A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 bouncycastle 0:1.70-4.amzn2023.0.3
Amazon Linux · 2023 bouncycastle-javadoc 0:1.70-4.amzn2023.0.3
Amazon Linux · 2023 bouncycastle-mail 0:1.70-4.amzn2023.0.3
Amazon Linux · 2023 bouncycastle-pg 0:1.70-4.amzn2023.0.3
Amazon Linux · 2023 bouncycastle-pkix 0:1.70-4.amzn2023.0.3
Amazon Linux · 2023 bouncycastle-tls 0:1.70-4.amzn2023.0.3
Amazon Linux · 2023 bouncycastle-util 0:1.70-4.amzn2023.0.3

Vulnerabilities 1

  • Medium 5.3
    CVE-2023-33201

    Bouncy Castle For Java LDAP injection vulnerability

    Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Cast…

    druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-33201.html