Description
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bouncycastle | 1.80-1 | — |
| Debian 13 | bouncycastle | 1.80-1 | — |
| Debian 12 | bouncycastle | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | bouncycastle | 1.77-1ubuntu0.1~esm1 | — |
| Ubuntu Pro 22.04 LTS | bouncycastle | 1.68-5ubuntu0.1~esm1 | — |
| Ubuntu Pro 20.04 LTS | bouncycastle | 1.61-1ubuntu0.1~esm1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | bouncycastle +6 | 1.70-4.amzn2023.0.5 | ALAS2023-2024-636 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 37.0.0-r8 | — |
| Wolfi rolling | gradle-8 | 8.7.0-r4 | — |
| Wolfi rolling | gradle-stage0 | No fix yet | — |
| Wolfi rolling | jruby-9.4 +1 | 9.4.8.0-r0 | — |
| Wolfi rolling | opensearch-2 | 2.16.0-r0 | — |
| Wolfi rolling | ruby3.2-bouncy-castle-java | 1.5.0146.1-r4 | — |
| Wolfi rolling | ruby3.3-bouncy-castle-java | 1.5.0146.1-r1 | — |
| Wolfi rolling | sonarqube-10 | 25.3.0.104237-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.bouncycastle:bcprov-jdk12 | >= 1.61, < 1.78 | 1.78 | GHSA-4h8f-2wvx-gg5w |
| Maven | org.bouncycastle:bcprov-jdk14 | >= 1.61, < 1.78 | 1.78 | GHSA-4h8f-2wvx-gg5w |
| Maven | org.bouncycastle:bcprov-jdk15on | >= 1.61, < 1.78 | 1.78 | GHSA-4h8f-2wvx-gg5w |
| Maven | org.bouncycastle:bcprov-jdk15to18 | >= 1.61, < 1.78 | 1.78 | GHSA-4h8f-2wvx-gg5w |
| Maven | org.bouncycastle:bcprov-jdk18on | >= 1.61, < 1.78 | 1.78 | GHSA-4h8f-2wvx-gg5w |
| Maven | org.bouncycastle:bcprov-lts8on | < 2.73.6 | 2.73.6 | GHSA-4h8f-2wvx-gg5w |
| Maven | org.bouncycastle:bctls-fips | < 1.0.19 | 1.0.19 | GHSA-4h8f-2wvx-gg5w |
Advisories 3
- WID-SEC-2024-1031 Bouncy Castle: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 23, 2026
- NCSC-2025-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 22, 2025
- ALAS2023-2024-636 Moderate: bouncycastle security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 10, 2024