CVE-2023-33202: Uncontrolled Resource Consumption

November 23, 2023 (updated January 25, 2024)

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.

References

bouncycastle.org/
github.com/bcgit/bc-java/wiki/CVE-2023-33202
nvd.nist.gov/vuln/detail/CVE-2023-33202

Code Behaviors & Features

Detect and mitigate CVE-2023-33202 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →