Description (CNA)
In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Legion of the Bouncy Castle Inc. / BC-JAVA | affected 0 before 1.85 |
| Legion of the Bouncy Castle Inc. / BC-LTS-JAVA | affected 2.73.0 before 2.73.12 |
| Legion of the Bouncy Castle Inc. / BC-FJA | affected 1.0.0 before 1.0.12; affected 2.0.0 before 2.0.12; affected 2.1.0 before 2.1.12 |
CWE
CWE-354
References
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9059642
- https://github.com/bcgit/bc-java/commit/2117f316a5a47308f3e569695a6592b16aac0dd7
ADP enrichment
No English description supplied.
No references supplied.