org.bouncycastle:bc-fips 1.0.2.7

Direct Vulnerabilities

Known vulnerabilities in the org.bouncycastle:bc-fips package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Improper Certificate Validation Affected versions of this package are vulnerable to Improper Certificate Validation in the `check()` method of `ProvOcspRevocationChecker`, which verifies a stapled OCSP response's signature and then treats the certificate as unrevoked when no `SingleResponse` entry matches its CertID, without requiring a binding match. An attacker can present a revoked certificate that BC-based clients accept as valid by stapling any legitimately signed OCSP response from the same CA, such as a good response for a different serial number. This applies when the client uses BC revocation checking with the response supplied through the stapled `PKIXRevocationChecker.setOcspResponses()` path rather than fetched over the network, and the response must be validly signed by the same issuer. How to fix Improper Certificate Validation? Upgrade `org.bouncycastle:bc-fips` to version 2.0.2, 2.1.3 or higher.	[,2.0.2)[2.1.0,2.1.3)
M Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `ASN1ObjectIdentifier`. An attacker can cause excessive resource consumption by submitting specially crafted ASN.1 Object Identifiers, potentially leading to service disruption. Note: This issue only applies to applications which do consume unvetted, or otherwise unvalidated, ASN.1 encodings. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.bouncycastle:bc-fips` to version 2.1.0 or higher.	[,2.1.0)

Vulnerability

Vulnerable Version

Improper Certificate Validation

Affected versions of this package are vulnerable to Improper Certificate Validation in the check() method of ProvOcspRevocationChecker, which verifies a stapled OCSP response's signature and then treats the certificate as unrevoked when no SingleResponse entry matches its CertID, without requiring a binding match. An attacker can present a revoked certificate that BC-based clients accept as valid by stapling any legitimately signed OCSP response from the same CA, such as a good response for a different serial number. This applies when the client uses BC revocation checking with the response supplied through the stapled PKIXRevocationChecker.setOcspResponses() path rather than fetched over the network, and the response must be validly signed by the same issuer.

How to fix Improper Certificate Validation?

Upgrade org.bouncycastle:bc-fips to version 2.0.2, 2.1.3 or higher.

[,2.0.2)[2.1.0,2.1.3)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ASN1ObjectIdentifier. An attacker can cause excessive resource consumption by submitting specially crafted ASN.1 Object Identifiers, potentially leading to service disruption.

Note: This issue only applies to applications which do consume unvetted, or otherwise unvalidated, ASN.1 encodings.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.bouncycastle:bc-fips to version 2.1.0 or higher.

[,2.1.0)

org.bouncycastle:bc-fips@1.0.2.7

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically