Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04eGZjLWdtNmctdmdwds4AA75b

Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Permalink: https://github.com/advisories/GHSA-8xfc-gm6g-vgpv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04eGZjLWdtNmctdmdwds4AA75b
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 4 months ago
Updated: 2 days ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Identifiers: GHSA-8xfc-gm6g-vgpv, CVE-2024-29857
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-29857
• https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9029857
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9029857
• https://www.bouncycastle.org/latest_releases.html
• https://github.com/bcgit/bc-csharp/commit/56daa6eac526f165416d17f661422d60de0dfd63
• https://github.com/bcgit/bc-java/commit/fee80dd230e7fba132d03a34f1dd1d6aae0d0281
• https://github.com/bcgit/bc-java/commit/efc498ca4caa340ac2fe11f2efee06c1a294501f
• https://github.com/advisories/GHSA-8xfc-gm6g-vgpv

Repository: https://github.com/bcgit/bc-csharp
Blast Radius: 23.7

Affected Packages