Affects Bouncy Castle for Java before 1.85. In the stapled OCSP path, ProvOcspRevocationChecker verifies the response signature and then searches for a SingleResponse matching the certificate's serial and issuer hashes, but returns normally when none matches, so the certificate is treated as unrevoked with no CRL fallback. The network-fetch path enforces this binding; the stapled path does not. A server holding a revoked certificate can staple any validly signed response …
Affects Bouncy Castle for Java before 1.85. RSADigestSigner.verifySignature() mis-computes the comparison offset in the branch handling DigestInfo encoded without NULL AlgorithmIdentifier parameters, leaving the final two hash bytes unchecked. A signature using that encoding is accepted for any message whose digest matches in all but the last two bytes, reducing second-preimage work by a factor of 2^16. The path is reachable by default from TLS, PKIX, CMS and OpenPGP RSA …
Affects Bouncy Castle for Java before 1.85. IETFUtils.valueToString() escapes special characters by inserting into the same buffer while iterating it, so each insertion shifts the remaining characters and a value of N escapable bytes costs on the order of N^2/2 moves. A single 60 KB RDN of commas or plus signs in a certificate, CSR, CRL or CMS structure pins a CPU core for seconds to minutes whenever the resulting …
Affects Bouncy Castle for Java before 1.85. Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are now grown incrementally through the stream, so a short payload fails as …
Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.
Affects Bouncy Castle for Java before 1.85. DHAgreement, implementing the MTI/A0 two-pass variant, raises the peer-supplied message value to the local static private key without any range or subgroup-membership check, unlike the validated public-key argument. A malicious peer that repeatedly sends small-order elements learns the private key modulo a small prime from each exchange and recovers it in full by combining them. DHBasicAgreement is unaffected because its only input is …
Affects Bouncy Castle for Java before 1.85. DSTU 7624 CCM mode folds the nonce into the MAC block only inside processAAD(), which is skipped when no associated data is present. Without AAD the MAC is a zero-IV CBC-MAC over the plaintext alone, so tags do not depend on the nonce. A chosen-plaintext attacker can derive the keystreams for two nonces in three oracle queries and forge a valid ciphertext and …
Affects Bouncy Castle for Java before 1.85. When IESEngine is initialised without a block cipher, the KDF output is split into an XOR keystream followed by the MAC key, so the MAC key offset depends on message length. Because the KDF is prefix-stable, one known plaintext reveals enough keystream to expose the MAC key for any shorter message. A passive observer can then forge authenticated ciphertexts the recipient accepts, without …
Affects Bouncy Castle for Java before 1.85. HSS/LMS parsing reads the level count from an encoded public key with no ceiling, then reads a second level count from the signature, validates it only against the attacker-supplied first value, and allocates an array of that size. RFC 8554 caps HSS depth at 8 but the check is applied only during key generation. An attacker supplying both public key and signature can …
Affects Bouncy Castle for Java before 1.85. CCMBlockCipher.processPacket(), and the equivalent KCCM and KGCM paths, decrypt into the caller's output array and check the authentication tag afterwards, leaving unverified plaintext in the buffer when verification fails. The buffer is never cleared, including by the JCE doFinal wrapper. An attacker who submits forged ciphertexts and can observe that buffer through pooled-buffer reuse, logging or memory inspection recovers the keystream XOR, reducing …
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() parses every keystore entry before checking the trailing HMAC, and sizes several buffers directly from length fields in the file. A BKS or UBER keystore declaring a length near 2^31 causes a multi-gigabyte allocation and OutOfMemoryError before the integrity check can reject it, stalling or killing the loading process.
Affects Bouncy Castle for Java before 1.85. BcKeyStoreSpi.engineLoad() accepts keystore versions 0, 1 and 2, and for versions other than 2 derives MAC parameters from a byte length where a bit length is expected, producing a 16-bit MAC key. The version field comes from the file and the property intended to gate legacy behaviour covered only a separate alias. Anyone able to supply or modify a .bks file can select …
Affects Bouncy Castle for Java before 1.85. BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours of CPU or gigabytes of memory before the MAC mismatch is detected.
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue only affects users of the FrodoKEM algorithm involved in the decryption of encapsulations. This issue affects BC-JAVA: from 1.71 to 1.80.1, 1.81, 1.82 to 1.83. Fixed versions: 1.80.2, 1.81.1, 1.84
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affects BC-JAVA: from 1.74 before 1.84.
The GOST 28147-2015 CTR mode implementation (G3413CTRBlockCipher) in the Legion of the Bouncy Castle BC-JAVA bcprov core module only increments the final byte of the counter, so the counter wraps after 255 blocks and the keystream is reused. Reusing CTR keystream allows an attacker who can observe two ciphertexts produced with the same key/IV to recover the XOR of the plaintexts, breaking confidentiality. Affects BC-JAVA from 1.59 before 1.84 (with …