CVE-2024-29857: Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.
5.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.37116%
CWE
Published
5/14/2024
Updated
12/6/2024
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.bouncycastle:bcprov-jdk18on | maven | < 1.78 | 1.78 |
| org.bouncycastle:bcprov-jdk15on | maven | < 1.78 | 1.78 |
| org.bouncycastle:bcprov-jdk15to18 | maven | < 1.78 | 1.78 |
| org.bouncycastle:bcprov-jdk14 | maven | < 1.78 | 1.78 |
| org.bouncycastle:bctls-jdk18on | maven | < 1.78 | 1.78 |
| org.bouncycastle:bctls-jdk14 | maven | < 1.78 | 1.78 |
| org.bouncycastle:bctls-jdk15to18 | maven | < 1.78 | 1.78 |
| org.bouncycastle:bc-fips | maven | < 1.0.2.5 | 1.0.2.5 |
| BouncyCastle | nuget | < 2.3.1 | |
| BouncyCastle.Cryptography | nuget | < 2.3.1 | 2.3.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from missing bounds checks in F2m curve parameter validation. The commit diffs show both Java and C# implementations added validation for the 'm' parameter in their respective ECCurve classes. The vulnerable versions allowed arbitrary m values without size restrictions, enabling crafted certificates to trigger computationally expensive operations. The test cases added in the commits (testLargeMInF2m) directly verify this boundary check, confirming these functions were the entry points for the vulnerability.