Bouncy Castle vulnerabilities

In Bouncy Castle for Java before 1.85, a Stapled OCSP response is accepted without binding to the checked certificate. This issue also affects LTS before 2.73.12 and FIPS before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Name Constraints can be bypassed via a trailing dot in rfc822Name and URI. This issue also affects LTS before 2.73.12 and FIPS before appropriate versions.

In Bouncy Castle for Java before 1.85, the MTI/A0 Diffie-Hellman key agreement exponentiates an unvalidated peer value. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, a possible Out-of-Memory (OOM) condition exists due to unbounded up-front allocation on a definite-length read. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, the PKCS#12 MAC and bag-decryption KDF iteration-count bound can lead to DoS. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, a Lazy ASN.1 sequence forces resetting the nesting-depth guard. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, RSA PKCS#1 signature verification skips the last two hash bytes in the NULL-omitted path. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, the MLS wire decoder allocates attacker-declared opaque length before bounds check.

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips the final tag on chunk-aligned data. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, the IESEngine in stream mode allows MAC forgery via length-dependent KDF split. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, the KCCMBlockCipher MAC does not bind the nonce when AAD is absent, allowing cross-nonce AEAD forgery. This also affects Bouncy Castle for Java LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the BCFKS keystore load honors unbounded KDF cost from an untrusted file. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to the caller buffer before tag check. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the HSS public-key level count is unbounded, enabling huge memory allocation on verify. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, stringifying X.500 distinguished names has quadratic time complexity, causing excessive processing time. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, LDAP filter injection exists in the legacy jdk1.4 LDAPStoreHelper component.

In Bouncy Castle for Java before 1.85, the BKS keystore accepts a legacy version with a 16-bit integrity MAC key. This also affects Bouncy Castle for Java LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, the OpenPGP user-attribute subpacket length is bounded only by JVM max memory. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the OpenPGP Argon2 S2K function honors attacker-chosen memory and passes. This also affects LTS before 2.73.12 and FIPS versions before specific bcpg-fips releases.

In Bouncy Castle for Java before 1.85, the CRMF/CMP password-MAC function honors an unbounded iteration count. This also affects LTS before 2.73.12 and FIPS versions before specific bcpkix-fips releases.

In Bouncy Castle for Java before 1.85, the DTLS handshake reassembler allocates a buffer from an unchecked 24-bit length. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the MLS hash-ratchet honors an arbitrary 32-bit generation counter from the sender.

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures are silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content is not bound to MAC when authAttrs are present. This issue also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the S/MIME validator trusts the signer-asserted signingTime for path validation. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the OpenPGP CFB quick-check oracle is active on symmetric/session-key paths. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the CMS verifySignatures method returns true for SignedData with zero signers. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the JSSE hostname verifier enables CN-fallback by default despite documented opt-in. This issue also affects LTS and FIPS versions.

In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honor an unbounded KDF cost from input. This also affects LTS before 2.73.12 and FIPS versions before specific bcpkix-fips releases.

In Bouncy Castle for Java before 1.85, the BKS/UBER keystore allocates memory from untrusted lengths before integrity check. This issue also affects LTS before 2.73.12.

In Bouncy Castle for Java (versions 1.73 to 1.78), three ML-KEM (CRYSTALS-Kyber) routines divide polynomial coefficients by the modulus q, allowing an attacker who measures the timing of many decapsulations with the same private key to recover that key. This affects Poly.toMsg (KyberSlash1) and ciphertext compression functions (KyberSlash2).

A vulnerability in BC-LTS and BC-FJA libraries from Legion of the Bouncy Castle Inc. on X86_64 with AVX and AVX-512f extensions on Linux. The issue involves program files gcm128w, gcm512w, gcm128w.C, and gcm512w.C.

A broken or risky cryptographic algorithm vulnerability was found in Bouncy Castle libraries (BC-JAVA, BCPKIX-FIPS, BCPIX-LTS) in pkix modules. The issue affects files JcaContentVerifierProviderBuilder.Java and JcaContentVerfierProviderBuilder.Java.