Description
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bouncycastle | 1.77-1 | — |
| Debian 13 | bouncycastle | 1.77-1 | — |
| Debian 12 | bouncycastle | No fix yet | — |
| Debian 10 | bouncycastle | 1.60-1+deb10u1 | DLA-3514-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | bouncycastle | 1.68-5ubuntu0.1~esm1 | — |
| Ubuntu Pro 20.04 LTS | bouncycastle | 1.61-1ubuntu0.1~esm1 | — |
| Ubuntu Pro 18.04 LTS | bouncycastle | 1.59-1ubuntu0.1~esm1 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | bouncycastle | 1.51-4ubuntu1+esm1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.11-2.redhat_00001.1.el7sso | RHSA-2023:7484, RHSA-2023:7483, RHSA-2023:7482 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-15.redhat_00049.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +5 | 1.76.0-4.redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.19-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.31-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.15-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.13-2.SP1_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-jboss-modules | 1.12.2-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-31.Final_redhat_00030.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.8.10-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-mod_cluster | 1.4.5-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-netty +28 | 4.1.94-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-resteasy +18 | 3.15.8-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.26-1.SP1_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.13-8.GA_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.20-1.Final_redhat_00001.1.el7eap | RHSA-2023:5486, RHSA-2023:5485, RHSA-2023:5484 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.13-8.GA_redhat_00001.1.el8eap | RHSA-2023:5486, RHSA-2023:5485 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
| SLES 15 SP4 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
| SLES 15 SP3 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
| SLES 15 SP2 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
| SLES for SAP 15 SP2 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
| SLE Real Time 15 SP3 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
| SLE HPC 15 SP3 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
| SLE HPC 15 SP2 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
| SUSE Enterprise Storage 7.1 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
| SUSE Enterprise Storage 7 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bouncycastle | 1.74-1.1 | openSUSE-SU-2024:13016-1 |
| openSUSE Leap 15.5 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
| openSUSE Leap 15.4 | bouncycastle | 1.74-150200.3.21.1 | SUSE-SU-2023:2843-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | bouncycastle +6 | 1.70-4.amzn2023.0.3 | ALAS2023-2023-280 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 37.0.0-r8 | — |
| Wolfi rolling | gradle-8 | 8.7.0-r1 | — |
| Wolfi rolling | gradle-stage0 | No fix yet | — |
| Wolfi rolling | tez | 0.10.4-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.bouncycastle:bcprov-debug-jdk14 | >= 1.49, < 1.74 | 1.74 | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-debug-jdk15on | >= 1.49, <= 1.70 | — | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-debug-jdk15to18 | < 1.74 | 1.74 | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-debug-jdk18on | < 1.74 | 1.74 | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-ext-jdk14 | >= 1.49, < 1.74 | 1.74 | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-ext-jdk15on | >= 1.49, <= 1.70 | — | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-ext-jdk15to18 | < 1.74 | 1.74 | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-ext-jdk18on | < 1.74 | 1.74 | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-jdk14 | >= 1.49, < 1.74 | 1.74 | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-jdk15on | >= 1.49, <= 1.70 | — | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-jdk15to18 | < 1.74 | 1.74 | GHSA-hr8g-6v94-x4m9 |
| Maven | org.bouncycastle:bcprov-jdk18on | < 1.74 | 1.74 | GHSA-hr8g-6v94-x4m9 |
Advisories 36
- RHSA-2023:5486 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2023:5485 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2023:5484 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2023:7483 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2023:7484 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2023:7482 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2024-0123 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 7, 2026
- WID-SEC-2023-1490 Bouncy Castle: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Mar 18, 2026
- DLA-3514-1 bouncycastle - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:13016-1 bouncycastle-1.74-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-3070 Red Hat JBoss A-MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 16, 2025
- WID-SEC-2024-0869 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 10, 2025
- WID-SEC-2023-2625 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 6, 2025
- WID-SEC-2024-0899 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2025
- SUSE-SU-2023:2843-1 Security update for bouncycastle SUSE / openSUSE Security Updates · May 2, 2025
- NCSC-2025-0025 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jan 22, 2025
- WID-SEC-2025-0144 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 21, 2025
- WID-SEC-2025-0136 Oracle Commerce: Schwachstelle gefährdet Vertraulichkeit BSI CERT-Bund (WID) · Jan 21, 2025
- WID-SEC-2023-3072 Red Hat Enterprise Linux(Cryostat): Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 17, 2024
- WID-SEC-2024-1642 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 20, 2024
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3218 Oracle Systems: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- NCSC-2024-0305 Kwetsbaarheden verholpen in Oracle Siebel CRM NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0302 Kwetsbaarheden verholpen in Oracle JD Edwards NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0294 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1657 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-1653 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-0873 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2024-0113 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 19, 2024
- WID-SEC-2024-0125 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0124 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0107 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2024-0106 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2023-2679 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-2675 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- ALAS2023-2023-280 Moderate: bouncycastle security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 9, 2023
References
- https://bouncycastle.org
- https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc
- https://github.com/bcgit/bc-java/wiki/CVE-2023-33201
- [debian-lts-announce] 20230802 [SECURITY] [DLA 3514-1] bouncycastle security update mailing-list
- https://security.netapp.com/advisory/ntap-20230824-0008/