Affects Bouncy Castle for Java LTS before 2.73.12. PBES2 decryptor builders pass the scrypt cost parameters and PBKDF2 iteration count from an attacker-supplied EncryptedPrivateKeyInfo, PKCS#12 or CMS structure straight into key derivation, and the same pattern appears in the OpenSSL PKCS#8 builder, CMS password recipients and PKCS12PfxPdu MAC verification. Because derivation runs before any integrity check, a small input can force gigabytes of scrypt memory or up to 2^31 HMAC …
Affects Bouncy Castle for Java LTS before 2.73.12. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.
Affects Bouncy Castle for Java LTS before 2.73.12. PKMACBuilder's default constructor leaves the iteration ceiling disabled, so when a CA or RA verifies a password-MAC protected CMP or CRMF message the iteration count is taken from the attacker's PBMParameter and drives the digest loop unbounded. A count near 2^31 occupies a server thread for hours, and a small number of requests exhausts the thread pool. The same unbounded pattern applies …
Affects Bouncy Castle for Java LTS before 2.73.12. CMSSignedData.verifySignatures() iterates the signer set and returns true once the loop completes, without requiring that any signer be present. RFC 5652 allows a degenerate SignedData with an empty signerInfos set, and neither the ASN.1 layer nor SignerInformationStore rejects one. An attacker can submit a CMS or PKCS#7 blob carrying arbitrary content and no signers; applications treating the return value as proof of …
Affects Bouncy Castle for Java LTS before 2.73.12. CMS AuthEnvelopedData recipients applied no lower bound to the AEAD tag length declared in the content-encryption AlgorithmIdentifier, a field the tag itself does not cover. Re-encoding a message to declare a truncated ICV, as low as 32 bits for the CCM family, weakens forgery resistance proportionally while decryption still succeeds. Recipients now accept a minimum tag size and reject shorter declarations before …
Affects Bouncy Castle for Java LTS before 2.73.12. RecipientInformation.getContentStream() digests the content separately while the MAC covers only the DER-encoded authenticated attributes, and the library never compares the computed digest against the messageDigest attribute that RFC 5652 requires. The documented usage pattern compares only the two MAC values, so callers following it never bind content to the MAC. An attacker can replace the encapsulated content while leaving the attributes and …