Description (CNA)
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Legion of the Bouncy Castle Inc. / BC-JAVA | affected 0 before 1.85 |
| Legion of the Bouncy Castle Inc. / BC-LTS-JAVA | affected 2.73.0 before 2.73.12 |
| Legion of the Bouncy Castle Inc. / BC-FJA | affected 1.0.0 before 1.0.12; affected 2.0.0 before 2.0.12; affected 2.1.0 before 2.1.12 |
CWE
CWE-347
References
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059639
- https://github.com/bcgit/bc-java/commit/99ddc6dcc6782e6a76b0dd587c77e62eb7096ad0
ADP enrichment
No English description supplied.
No references supplied.