-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.bouncycastle:bcpkix-jdk15on | maven | >= 1.44, <= 1.78 | 1.79 |
| org.bouncycastle:bcpkix-jdk15to18 | maven | >= 1.44, <= 1.78 | 1.79 |
| org.bouncycastle:bcpkix-jdk18on | maven | >= 1.44, <= 1.78 | 1.79 |
| org.bouncycastle:bcpkix-fips | maven | >= 1.0.0, <= 1.0.7 | 1.0.8 |
| org.bouncycastle:bcpkix-fips | maven | >= 2.0.0, <= 2.0.7 | 2.0.8 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability lies in the checkNameConstraints method of two different PKIXCertPathReviewer classes within the Bouncy Castle library. Both of these methods are responsible for handling subject alternative names from X.509 certificates during path validation. The core of the vulnerability is the lack of a size check on the number of alternative names. An attacker can create a malicious certificate with an extremely large number of these names. When a Java application using a vulnerable version of Bouncy Castle attempts to validate a certificate path containing this malicious certificate, the checkNameConstraints method will be called. This method would then attempt to process all the alternative names, leading to a massive memory allocation that can exhaust the heap space of the Java Virtual Machine, causing a denial-of-service. The provided patches fix this by introducing a hard limit (NAME_CHECK_MAX) on the number of alternative names that will be processed, preventing the excessive allocation.
Ongoing coverage of React2Shell