bouncycastle:bcprov-jdk12 140

Direct Vulnerabilities

Known vulnerabilities in the bouncycastle:bcprov-jdk12 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Allocation of Resources Without Limits or Throttling bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `engineLoad()` method of `BcFKSKeyStoreSpi`, which reads HMAC PBKDF2 or scrypt cost parameters from a keystore's integrity structures and runs key derivation before MAC verification, with PBKDF2 rejecting only a zero iteration count and scrypt enforcing no cost limit. An attacker can consume CPU for minutes to hours or allocate gigabytes of memory by supplying a `.bcfks` file that declares a large iteration count, up to 2^31-1, or large scrypt N/r values. This requires the application to load an attacker-supplied or modifiable `.bcfks` keystore, and the cost is incurred before the MAC mismatch is detected. How to fix Allocation of Resources Without Limits or Throttling? There is no fixed version for `bouncycastle:bcprov-jdk12`.	[0,)
M Cryptographic Issues bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Cryptographic Issues. The TLS implementation does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. How to fix Cryptographic Issues? There is no fixed version for `bouncycastle:bcprov-jdk12`.	[0,)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad() method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters from a keystore's integrity structures and runs key derivation before MAC verification, with PBKDF2 rejecting only a zero iteration count and scrypt enforcing no cost limit. An attacker can consume CPU for minutes to hours or allocate gigabytes of memory by supplying a .bcfks file that declares a large iteration count, up to 2^31-1, or large scrypt N/r values. This requires the application to load an attacker-supplied or modifiable .bcfks keystore, and the cost is incurred before the MAC mismatch is detected.

How to fix Allocation of Resources Without Limits or Throttling?

There is no fixed version for bouncycastle:bcprov-jdk12.

[0,)

Cryptographic Issues

bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Cryptographic Issues. The TLS implementation does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

How to fix Cryptographic Issues?

There is no fixed version for bouncycastle:bcprov-jdk12.

[0,)

bouncycastle:bcprov-jdk12@140

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically