| Package | Affected versions | Patched versions |
|---|---|---|
| org.bouncycastle:bcprov-jdk14 | ≥ 1.63, < 1.64 | 1.64 |
| tomee | = 7.0.7= 7.1.2= 8.0.1 | |
| bc-java | = 1.63 | |
| active iq unified manager | ≥ 7.3≥ 9.5 | |
| business process management suite | = 12.2.1.3.0= 12.2.1.4.0 | |
| communications convergence | ≥ 3.0.1.0, ≤ 3.0.2.1 | |
| communications diameter signaling router | ≥ 8.0.0, ≤ 8.2.2 | |
| communications session route manager | ≥ 8.2.0, ≤ 8.2.2 | |
| data integrator | = 12.2.1.4.0 | |
| financial services analytical applications infrastructure | ≥ 8.0.6, ≤ 8.0.9 | |
| flexcube private banking | = 12.0.0= 12.1.0 | |
| hospitality guest access | = 4.2.0 | |
| managed file transfer | = 12.2.1.3.0= 12.2.1.4.0 | |
| peoplesoft enterprise hcm global payroll switzerland | = 9.2 | |
| peoplesoft enterprise peopletools | = 8.56= 8.57= 8.58 | |
| retail xstore point of service | = 18.0.1 | |
| soa suite | = 12.2.1.3.0= 12.2.1.4.0 | |
| webcenter portal | = 11.1.1.9.0= 12.2.1.3.0= 12.2.1.4.0 | |
| weblogic server | = 12.2.1.3.0= 12.2.1.4.0 |
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free