In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2016-1000342 · ADVISORY
• bcgit/bc-java commit 843c2e6 · WEB
• access.redhat.com/errata/RHSA-2018:2669 · WEB
• access.redhat.com/errata/RHSA-2018:2927 · WEB
• bcgit/bc-java · PACKAGE
• lists.debian.org/debian-lts-announce/2018/07/msg00009.html · WEB
• security.netapp.com/advisory/ntap-20181127-0004 · WEB
• usn.ubuntu.com/3727-1 · WEB
• oracle.com/security-alerts/cpuoct2020.html · WEB
• security.netapp.com/advisory/ntap-20181127-0004
• usn.ubuntu.com/3727-1

org.bouncycastle:bcprov-jdk14 のその他の脆弱性

• CVE-2026-5598高 7.5Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associat…
• CVE-2026-0636中 6.5Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JA…
• CVE-2025-14813高 7.5: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). …
• CVE-2025-8885中 6.3Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), …
• CVE-2024-30172高 7.5An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a craf…