Skip to content
OpenAdvisories
Medium ALAS2023-2024-636 2 CVEs

Moderate: bouncycastle security update (Amazon Linux 2023)

Published Jun 6, 2024 · Updated Jun 10, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-34447: An issue was discovered in Bouncy Castle Java Cryptography APIs before BC 1.78. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning. CVE-2024-29857: An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 bouncycastle 0:1.70-4.amzn2023.0.5
Amazon Linux · 2023 bouncycastle-javadoc 0:1.70-4.amzn2023.0.5
Amazon Linux · 2023 bouncycastle-mail 0:1.70-4.amzn2023.0.5
Amazon Linux · 2023 bouncycastle-pg 0:1.70-4.amzn2023.0.5
Amazon Linux · 2023 bouncycastle-pkix 0:1.70-4.amzn2023.0.5
Amazon Linux · 2023 bouncycastle-tls 0:1.70-4.amzn2023.0.5
Amazon Linux · 2023 bouncycastle-util 0:1.70-4.amzn2023.0.5

Vulnerabilities 2

  • High 7.5
    CVE-2024-29857

    Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

    An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CP…

    druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven NuGet
  • High 7.5
    CVE-2024-34447

    Bouncy Castle Java Cryptography API vulnerable to DNS poisoning

    An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is creat…

    druid bouncycastle bouncycastle opensearch-2 Debian Ubuntu Wolfi Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-29857.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-34447.html