Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). UserAttributeSubpacketInputStream.readPacket() reads a five-octet subpacket length of up to Integer.MAX_VALUE and allocates a buffer after checking it only against a limit that, for the wrapped stream types involved, resolves to the JVM maximum heap size rather than the enclosing packet length. Importing a public key from a keyserver, WKD or attachment …
Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 2.0.13 (2.0.X series). In OpenPGPMessageInputStream each one-pass signature is passed through a policy check that rejects weak hashes, unacceptable keys, unknown critical subpackets and pre-dated signatures. The enclosing catch block contains only a comment where a continue statement should be, so a policy rejection falls through to cryptographic verification and, if that succeeds, the signature is recorded as tested and correct. …
Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). PGPSymmetricKeyEncryptedData.getDataStream() still performs the CFB quick check on the repeated IV bytes and throws before the MDC is verified, on the symmetric and session-key paths. The public-key path already omits this check to avoid the Mister-Zuccherato oracle, and no property gates the remaining one. An attacker with adaptive chosen-ciphertext access can …
Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). Parsing an OpenPGP Argon2 S2K specifier reads the passes, parallelism and memory-size exponent fields with only a default cap of 2^30 KiB on the exponent, and passes all three straight into the Argon2 generator. An attacker controls every parameter in a small SKESK or secret-key packet, so a victim who merely …
Affects Bouncy Castle for Java FIPS (BC-FJA) bcpg-fips before 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). OpenPGP AEAD decryption verifies the final tag only when the last chunk is shorter than the chunk length. For chunk-aligned data the stream reports clean EOF without calling doFinal(), and AEAD verification always reports success, so nothing detects the omission. An attacker who controls the ciphertext can drop trailing chunks and …