View all vulnerabilities

CVE-2024-29857

Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
5.3
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Versions
org.bouncycastle:bcprov-jdk18on < 1.78; org.bouncycastle:bcprov-jdk15on < 1.78; org.bouncycastle:bcprov-jdk15to18 < 1.78; org.bouncycastle:bcprov-jdk14 < 1.78; org.bouncycastle:bctls-jdk18on < 1.78; org.bouncycastle:bctls-jdk14 < 1.78; org.bouncycastle:bctls-jdk15to18 < 1.78; org.bouncycastle:bc-fips < 1.0.2.5; BouncyCastle.Cryptography < 2.3.1
Severity
Medium
Ecosystem
Publish Date
May 14, 2024
Modified Date
December 6, 2024