Advisories for Maven/Org.bouncycastle/Bcpg-Lts8on package

Affects Bouncy Castle for Java LTS before 2.73.12. UserAttributeSubpacketInputStream.readPacket() reads a five-octet subpacket length of up to Integer.MAX_VALUE and allocates a buffer after checking it only against a limit that, for the wrapped stream types involved, resolves to the JVM maximum heap size rather than the enclosing packet length. Importing a public key from a keyserver, WKD or attachment can therefore force a near-heap-sized allocation from a few dozen bytes, …

Affects Bouncy Castle for Java LTS before 2.73.12. PGPSymmetricKeyEncryptedData.getDataStream() still performs the CFB quick check on the repeated IV bytes and throws before the MDC is verified, on the symmetric and session-key paths. The public-key path already omits this check to avoid the Mister-Zuccherato oracle, and no property gates the remaining one. An attacker with adaptive chosen-ciphertext access can distinguish the early failure from later ones and recover two plaintext …

Affects Bouncy Castle for Java LTS before 2.73.12. Parsing an OpenPGP Argon2 S2K specifier reads the passes, parallelism and memory-size exponent fields with only a default cap of 2^30 KiB on the exponent, and passes all three straight into the Argon2 generator. An attacker controls every parameter in a small SKESK or secret-key packet, so a victim who merely enters a passphrase to attempt decryption triggers an attacker-chosen allocation of …

Affects Bouncy Castle for Java LTS before 2.73.12. OpenPGP AEAD decryption verifies the final tag only when the last chunk is shorter than the chunk length. For chunk-aligned data the stream reports clean EOF without calling doFinal(), and AEAD verification always reports success, so nothing detects the omission. An attacker who controls the ciphertext can drop trailing chunks and the final tag, adjust the unauthenticated outer packet length, and have …