Description (CNA)
In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Legion of the Bouncy Castle Inc. / BC-JAVA | affected 0 before 1.85 |
| Legion of the Bouncy Castle Inc. / BC-LTS-JAVA | affected 2.73.0 before 2.73.12 |
| Legion of the Bouncy Castle Inc. / BC-FJA | affected 1.0.0 before 1.0.2.7; affected 2.0.0 before 2.0.2; affected 2.1.0 before 2.1.3 |
CWE
CWE-770
References
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9058063
- https://github.com/bcgit/bc-java/commit/81737a56ef4489da1f849cf549df95e338ea6b06
ADP enrichment
No English description supplied.
No references supplied.