Affects Bouncy Castle for Java LTS before 2.73.12. In the stapled OCSP path, ProvOcspRevocationChecker verifies the response signature and then searches for a SingleResponse matching the certificate's serial and issuer hashes, but returns normally when none matches, so the certificate is treated as unrevoked with no CRL fallback. The network-fetch path enforces this binding; the stapled path does not. A server holding a revoked certificate can staple any validly signed …
Affects Bouncy Castle for Java LTS before 2.73.12. RSADigestSigner.verifySignature() mis-computes the comparison offset in the branch handling DigestInfo encoded without NULL AlgorithmIdentifier parameters, leaving the final two hash bytes unchecked. A signature using that encoding is accepted for any message whose digest matches in all but the last two bytes, reducing second-preimage work by a factor of 2^16. The path is reachable by default from TLS, PKIX, CMS and OpenPGP …
Affects Bouncy Castle for Java LTS before 2.73.12. IETFUtils.valueToString() escapes special characters by inserting into the same buffer while iterating it, so each insertion shifts the remaining characters and a value of N escapable bytes costs on the order of N^2/2 moves. A single 60 KB RDN of commas or plus signs in a certificate, CSR, CRL or CMS structure pins a CPU core for seconds to minutes whenever the …
Affects Bouncy Castle for Java LTS before 2.73.12. Definite-length ASN.1 parsing allocated the entire declared object length as soon as the header was read. A few crafted header bytes arriving over a non-rewindable stream, such as a TLS record layer or a socket-backed certificate read, could trigger a near-heap-sized allocation before any content byte was consumed. Definite-length objects are now grown incrementally through the stream, so a short payload fails …
Affects Bouncy Castle for Java LTS before 2.73.12. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.
Affects Bouncy Castle for Java LTS before 2.73.12. DHAgreement, implementing the MTI/A0 two-pass variant, raises the peer-supplied message value to the local static private key without any range or subgroup-membership check, unlike the validated public-key argument. A malicious peer that repeatedly sends small-order elements learns the private key modulo a small prime from each exchange and recovers it in full by combining them. DHBasicAgreement is unaffected because its only input …
Affects Bouncy Castle for Java LTS before 2.73.12. DSTU 7624 CCM mode folds the nonce into the MAC block only inside processAAD(), which is skipped when no associated data is present. Without AAD the MAC is a zero-IV CBC-MAC over the plaintext alone, so tags do not depend on the nonce. A chosen-plaintext attacker can derive the keystreams for two nonces in three oracle queries and forge a valid ciphertext …
Affects Bouncy Castle for Java LTS before 2.73.12. When IESEngine is initialised without a block cipher, the KDF output is split into an XOR keystream followed by the MAC key, so the MAC key offset depends on message length. Because the KDF is prefix-stable, one known plaintext reveals enough keystream to expose the MAC key for any shorter message. A passive observer can then forge authenticated ciphertexts the recipient accepts, …
Affects Bouncy Castle for Java LTS before 2.73.12. HSS/LMS parsing reads the level count from an encoded public key with no ceiling, then reads a second level count from the signature, validates it only against the attacker-supplied first value, and allocates an array of that size. RFC 8554 caps HSS depth at 8 but the check is applied only during key generation. An attacker supplying both public key and signature …
Affects Bouncy Castle for Java LTS before 2.73.12. CCMBlockCipher.processPacket(), and the equivalent KCCM and KGCM paths, decrypt into the caller's output array and check the authentication tag afterwards, leaving unverified plaintext in the buffer when verification fails. The buffer is never cleared, including by the JCE doFinal wrapper. An attacker who submits forged ciphertexts and can observe that buffer through pooled-buffer reuse, logging or memory inspection recovers the keystream XOR, …
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
Affects Bouncy Castle for Java LTS before 2.73.12. BcKeyStoreSpi.engineLoad() parses every keystore entry before checking the trailing HMAC, and sizes several buffers directly from length fields in the file. A BKS or UBER keystore declaring a length near 2^31 causes a multi-gigabyte allocation and OutOfMemoryError before the integrity check can reject it, stalling or killing the loading process.
Affects Bouncy Castle for Java LTS before 2.73.12. BcKeyStoreSpi.engineLoad() accepts keystore versions 0, 1 and 2, and for versions other than 2 derives MAC parameters from a byte length where a bit length is expected, producing a 16-bit MAC key. The version field comes from the file and the property intended to gate legacy behaviour covered only a separate alias. Anyone able to supply or modify a .bks file can …
Affects Bouncy Castle for Java LTS before 2.73.12. BcFKSKeyStoreSpi.engineLoad() takes the KDF algorithm and parameters from the untrusted keystore before running verifyMac(), then feeds the file-supplied PBKDF2 iteration count or scrypt cost directly into derivation with no ceiling. A modified .bcfks file declaring an iteration count near 2^31, or scrypt parameters sized to available RAM, consumes minutes to hours of CPU or gigabytes of memory before the MAC mismatch is …
In Bouncy Castle LTS for Java, the AES/GCM native implementation used on Intel CPUs with AES PAA instruction sets (AVX / VAES / VAESF variants) can intermittently produce an incorrect authentication tag verification result during decryption when the ciphertext is fed in via a mix of update() calls followed by doFinal(). It is possible to work around it by either using doFinal() only (as the BCJSSE does) or by configuring …