org.bouncycastle:bcprov-jdk12 130

Direct Vulnerabilities

Known vulnerabilities in the org.bouncycastle:bcprov-jdk12 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improper Validation of Integrity Check Value org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value enabling MAC forgery, in the `IESEngine` class when initialized through the 4-argument `init` without a block cipher, where the KDF is seeded only from the ECDH shared secret and split into a message-length K1 keystream and a K2 MAC key, so the MAC key's position depends on the message length. An attacker can forge arbitrary authenticated ciphertexts from a single known plaintext-ciphertext pair, since K1 is an XOR keystream that reveals the prefix-stable KDF output and lets the MAC keys for shorter messages be derived. This affects only stream-mode `IESEngine` initialized with no block cipher where the ephemeral value V is empty, and requires the attacker to hold one known plaintext-ciphertext pair. How to fix Improper Validation of Integrity Check Value? There is no fixed version for `org.bouncycastle:bcprov-jdk12`.	[0,)
H Improper Validation of Integrity Check Value org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the `processPacket()` method of `KCCMBlockCipher`, which invokes `processAAD()` only when associated data is present, so with no AAD the G1 block (nonce, length, flag) is never mixed into the MAC and the tag reduces to a CBC-MAC over the ciphertext alone, independent of the nonce. An attacker with encryption-oracle access can assemble a valid ciphertext and tag for any never-queried plaintext and nonce pair by deriving the data and tag keystreams from two nonces. This affects only DSTU 7624 CCM encryption performed without any associated data, and requires chosen-plaintext access to an encryption oracle. How to fix Improper Validation of Integrity Check Value? There is no fixed version for `org.bouncycastle:bcprov-jdk12`.	[0,)
H Improper Validation of Integrity Check Value org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the `processPacket()` method of `CCMBlockCipher`, with equivalent paths in `KCCMBlockCipher` and `KGCMBlockCipher`, which decrypt directly into the caller's output buffer and leave the unverified plaintext there when the authentication tag check fails. An attacker can recover `AES-CTR(key, nonce) XOR ciphertext`, effectively reducing CCM to unauthenticated CTR, by submitting forged ciphertexts and reading the output buffer on the failure path. This requires the attacker to submit ciphertexts and observe the caller's output buffer after a failed verification, for example through pooled-buffer reuse, logging, or memory inspection. How to fix Improper Validation of Integrity Check Value? There is no fixed version for `org.bouncycastle:bcprov-jdk12`.	[0,)
H Uncontrolled Recursion org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Uncontrolled Recursion in the `force()` method of `LazyEncodedSequence`, which parses the deferred SEQUENCE with a fresh `ASN1InputStream` whose nesting-depth counter is reset rather than inherited from the parent parse, and never calls `createSubStream()` or `decrementDepth()`. An attacker can crash the handling thread with a `StackOverflowError` by supplying a 40-50 KB DER-encoded CRL whose `revokedCertificates` field nests roughly 10,000 SEQUENCE structures. This requires the application to parse the CRL through `X509CRLHolder` or the BC `CertificateFactory` path, where `revokedCertificates` is held as an unevaluated lazy sequence until forced. How to fix Uncontrolled Recursion? There is no fixed version for `org.bouncycastle:bcprov-jdk12`.	[0,)
M Allocation of Resources Without Limits or Throttling org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in `PKCS12KeyStoreSpi`, which feeds the attacker-controlled KDF iteration count from a PKCS#12 file's MAC data and encrypted bags into key derivation during `engineLoad()` without enforcing any upper bound. An attacker can pin a CPU core for an extended period and exhaust server resources by supplying a PKCS#12 keystore whose MAC or bag PBE parameters declare a very large iteration count, up to 2^31-1. This requires the application to load the attacker-supplied keystore, and the costly derivation runs during MAC verification and bag decryption regardless of whether the supplied password matches. How to fix Allocation of Resources Without Limits or Throttling? There is no fixed version for `org.bouncycastle:bcprov-jdk12`.	[0,)
H Memory Allocation with Excessive Size Value org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the `toByteArray()` method of `DefiniteLengthInputStream`, which allocates `new byte[(int)_remaining]` up front from the declared ASN.1 definite-length value before reading any content. An attacker can drive the JVM to `OutOfMemoryError` with a small input by supplying an ASN.1 structure whose definite-length header declares a near-heap-sized length that the content never satisfies. This requires the application to parse attacker-supplied ASN.1 or DER input, such as certificates, CMS structures, or keys, through Bouncy Castle. How to fix Memory Allocation with Excessive Size Value? There is no fixed version for `org.bouncycastle:bcprov-jdk12`.	[0,)
H Inefficient Algorithmic Complexity org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the `IETFUtils.valueToString()` method, reached through `X500Name.toString()`, `equals()`, and `hashCode()` via `AbstractX500NameStyle`, which escapes each special character with `vBuf.insert(index, "\\")` on the same buffer so a value of N escapable bytes costs roughly N²/2 character moves. An attacker can pin a CPU core for seconds to minutes, and saturate the server with a few parallel submissions, by supplying an X.509 certificate, CSR, CRL, or CMS structure containing a single ~60 KB RDN of commas or plus signs. Exploitation only requires a code path that logs, pretty-prints, compares, or hashes the resulting `X500Name`, including JCA `X509Certificate.getSubjectX500Principal().toString()` and BC certificate selectors and caches. How to fix Inefficient Algorithmic Complexity? There is no fixed version for `org.bouncycastle:bcprov-jdk12`.	[0,)
H Improper Verification of Cryptographic Signature org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the `verifySignature()` method of `RSADigestSigner`, whose legacy NULL-omitted `DigestInfo` path computes comparison offsets as `length - hash.length - 2`, so its two comparison loops jointly cover only bytes `[0..sig.length-2)` and leave the final two hash bytes unverified. An attacker can forge an RSA PKCS#1 signature by producing a message whose digest matches the signed digest in every byte except the last two, reducing the second-preimage work factor by 2^16. The flawed path is reachable by default only for signatures using NULL-less `DigestInfo` encoding, across BC-lightweight TLS `rsa_pkcs1_*`, PKIX/CMS, and OpenPGP RSA verification, and only when `org.bouncycastle.pkcs1.strict_digestinfo` is not set. How to fix Improper Verification of Cryptographic Signature? There is no fixed version for `org.bouncycastle:bcprov-jdk12`.	[0,)
M Cryptographic Issues org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Cryptographic Issues. The TLS implementation does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. How to fix Cryptographic Issues? There is no fixed version for `org.bouncycastle:bcprov-jdk12`.	[0,)

Vulnerability

Vulnerable Version

Improper Validation of Integrity Check Value

org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms.

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value enabling MAC forgery, in the IESEngine class when initialized through the 4-argument init without a block cipher, where the KDF is seeded only from the ECDH shared secret and split into a message-length K1 keystream and a K2 MAC key, so the MAC key's position depends on the message length. An attacker can forge arbitrary authenticated ciphertexts from a single known plaintext-ciphertext pair, since K1 is an XOR keystream that reveals the prefix-stable KDF output and lets the MAC keys for shorter messages be derived. This affects only stream-mode IESEngine initialized with no block cipher where the ephemeral value V is empty, and requires the attacker to hold one known plaintext-ciphertext pair.

How to fix Improper Validation of Integrity Check Value?