Skip to content
OpenAdvisories
High · 7.5 CVE-2024-29857 EUVD-2024-1533GHSA-8xfc-gm6g-vgpv

Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

Published May 9, 2024 · Updated Feb 13, 2025 · Assigned by mitre

Package: bouncycastle Package: bouncycastle Package: BouncyCastle Package: BouncyCastle.Cryptography Package: druid Package: gradle-8 Package: gradle-stage0 Package: jruby-9.4 Package: jruby-9.4-default-ruby Package: opensearch-2 Package: org.bouncycastle:bc-fips Package: org.bouncycastle:bcprov-jdk14 Package: org.bouncycastle:bcprov-jdk15on Package: org.bouncycastle:bcprov-jdk15to18 Package: org.bouncycastle:bcprov-jdk18on Package: org.bouncycastle:bctls-jdk14 Package: org.bouncycastle:bctls-jdk15to18 Package: org.bouncycastle:bctls-jdk18on Package: ruby3.2-bouncy-castle-java Package: ruby3.3-bouncy-castle-java Package: sonarqube-10 Package: tez Ecosystem: Debian Ecosystem: Maven Ecosystem: NuGet Ecosystem: Ubuntu Ecosystem: Wolfi

Description

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 bouncycastle 1.80-1 —
Debian 13 bouncycastle 1.80-1 —
Debian 12 bouncycastle No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS bouncycastle 1.77-1ubuntu0.1~esm1 —
Ubuntu Pro 22.04 LTS bouncycastle 1.68-5ubuntu0.1~esm1 —
Ubuntu Pro 20.04 LTS bouncycastle 1.61-1ubuntu0.1~esm1 —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS bouncycastle 1.59-1ubuntu0.1~esm1 —
Ubuntu Pro 16.04 LTS bouncycastle No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 8 eap8-activemq-artemis +14 2.21.0-5.redhat_00052.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-angus +1 2.0.3-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-angus-activation 2.0.1-3.redhat_00006.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-beanutils 1.9.4-13.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-cli 1.4.0-2.redhat_00003.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-commons-codec 1.15.0-6.redhat_00016.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.0.4-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-mime4j +2 0.8.11-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-apache-sshd 2.12.1-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-bouncycastle +5 1.78.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-byte-buddy 1.14.18-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-caffeine 3.1.8-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-cxf-xjc-dv +5 4.0.0-5.redhat_00003.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.3.0-2.GA_redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-guava +1 33.0.0-1.jre_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-guava-failureaccess 1.0.2-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-hal-console 3.6.19-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-hornetq +3 2.4.9-4.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-asyncclient 4.1.5-3.redhat_00005.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-client 4.5.14-4.redhat_00012.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-httpcomponents-core 4.4.16-4.redhat_00010.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-infinispan +20 14.0.30-2.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-mail +1 2.1.3-1.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-servlet-api 6.0.0-5.redhat_00006.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-websocket +2 2.1.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jakarta-xml-bind-api 4.0.1-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jandex 3.0.8-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jasypt 1.9.3-4.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-java-classmate 1.5.1-3.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jaxb +9 4.0.5-2.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jboss-metadata +5 16.0.0-3.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jboss-openjdk-orb 10.1.0-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.1.0-1.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-joda-time 2.12.7-1.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-jsf-impl 4.0.7-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-mod_cluster 2.0.3-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-neethi 3.2.0-1.redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-netty +14 4.1.108-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-netty-xnio-transport 0.1.10-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-opensaml +13 4.2.0-4.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-parsson 1.1.5-2.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-reactivex-rxjava 3.1.8-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-resteasy +15 6.2.7-2.Final_redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.13-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-stax2-api 4.2.2-1.redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-velocity +1 2.3.0-3.redhat_00009.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-weld-ejb +6 5.1.2-2.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly +3 8.0.3-9.GA_redhat_00004.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly-discovery +1 1.3.0-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wildfly-elytron +1 2.2.6-1.Final_redhat_00001.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wsdl4j 1.6.3-5.redhat_00008.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-wss4j +6 3.0.3-1.redhat_00008.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-xml-security 3.0.4-1.redhat_00005.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 8 eap8-yasson 3.0.3-3.redhat_00002.1.el8eap RHSA-2024:5481, RHSA-2024:5479
Red Hat JBoss EAP 7 eap7-bouncycastle +5 1.78.1-1.redhat_00002.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-hal-console 3.3.23-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.17-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jandex 2.4.5-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.29-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-37.Final_redhat_00037.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.8.16-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-log4j-jboss-logmanager 1.3.1-1.Final_redhat_00002.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-netty +28 4.1.108-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-netty-xnio-transport 0.1.10-1.Final_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-undertow 2.2.33-1.SP1_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.18-1.GA_redhat_00001.1.el7eap RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.18-1.GA_redhat_00001.1.el8eap RHSA-2024:5145, RHSA-2024:5144

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bouncycastle 1.78.1-1.1 openSUSE-SU-2024:13914-1
openSUSE Tumbleweed itextpdf 5.5.13.4-1.1 openSUSE-SU-2025:15739-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 bouncycastle +6 1.70-4.amzn2023.0.5 ALAS2023-2024-636

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling druid 37.0.0-r8 —
Wolfi rolling gradle-8 8.7.0-r4 —
Wolfi rolling gradle-stage0 No fix yet —
Wolfi rolling jruby-9.4 +1 9.4.8.0-r0 —
Wolfi rolling opensearch-2 2.16.0-r0 —
Wolfi rolling ruby3.2-bouncy-castle-java 1.5.0146.1-r4 —
Wolfi rolling ruby3.3-bouncy-castle-java 1.5.0146.1-r1 —
Wolfi rolling sonarqube-10 25.2.0.102705-r0 —
Wolfi rolling tez 0.10.4-r6 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.bouncycastle:bc-fips < 1.0.2.5 1.0.2.5 GHSA-8xfc-gm6g-vgpv
Maven org.bouncycastle:bcprov-jdk14 < 1.78 1.78 GHSA-8xfc-gm6g-vgpv
Maven org.bouncycastle:bcprov-jdk15on < 1.78 1.78 GHSA-8xfc-gm6g-vgpv
Maven org.bouncycastle:bcprov-jdk15to18 < 1.78 1.78 GHSA-8xfc-gm6g-vgpv
Maven org.bouncycastle:bcprov-jdk18on < 1.78 1.78 GHSA-8xfc-gm6g-vgpv
Maven org.bouncycastle:bctls-jdk14 < 1.78 1.78 GHSA-8xfc-gm6g-vgpv
Maven org.bouncycastle:bctls-jdk15to18 < 1.78 1.78 GHSA-8xfc-gm6g-vgpv
Maven org.bouncycastle:bctls-jdk18on < 1.78 1.78 GHSA-8xfc-gm6g-vgpv
NuGet BouncyCastle all versions — GHSA-8xfc-gm6g-vgpv
NuGet BouncyCastle.Cryptography < 2.3.1 2.3.1 GHSA-8xfc-gm6g-vgpv

Advisories 28

References