CVE-2023-33202: Bouncy Castle Denial of Service (DoS)

November 23, 2023 (updated September 9, 2024)

Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.

References

bouncycastle.org/
github.com/advisories/GHSA-wjxj-5m7g-mg7q
github.com/bcgit/bc-java
github.com/bcgit/bc-java/commit/0c576892862ed41894f49a8f639112e8d66d229c
github.com/bcgit/bc-java/wiki/CVE-2023-33202
nvd.nist.gov/vuln/detail/CVE-2023-33202
security.netapp.com/advisory/ntap-20240125-0001

Code Behaviors & Features

Detect and mitigate CVE-2023-33202 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →