Skip to content
OpenAdvisories
Medium ALAS2023-2024-479 1 CVE

Moderate: bouncycastle security update (Amazon Linux 2023)

Published Jan 3, 2024 · Updated Jan 8, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-33202: Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 bouncycastle 0:1.70-4.amzn2023.0.4
Amazon Linux · 2023 bouncycastle-javadoc 0:1.70-4.amzn2023.0.4
Amazon Linux · 2023 bouncycastle-mail 0:1.70-4.amzn2023.0.4
Amazon Linux · 2023 bouncycastle-pg 0:1.70-4.amzn2023.0.4
Amazon Linux · 2023 bouncycastle-pkix 0:1.70-4.amzn2023.0.4
Amazon Linux · 2023 bouncycastle-tls 0:1.70-4.amzn2023.0.4
Amazon Linux · 2023 bouncycastle-util 0:1.70-4.amzn2023.0.4

Vulnerabilities 1

  • Medium 5.5
    CVE-2023-33202

    Bouncy Castle Denial of Service (DoS)

    Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7…

    bouncycastle bouncycastle gradle-8 gradle-stage0 Debian Ubuntu Wolfi Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-33202.html