Infinite loop Affecting bouncycastle.cryptography package, versions [,2.3.1)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-BOUNCYCASTLECRYPTOGRAPHY-7831268
- published 26 Aug 2024
- disclosed 12 Apr 2024
- credit jr981008
Introduced: 12 Apr 2024
CVE-2024-30172 Open this link in a new tabHow to fix?
Upgrade BouncyCastle.Cryptography to version 2.3.1 or higher.
Overview
Affected versions of this package are vulnerable to Infinite loop in ED25519 verification in the ScalarUtil class. An attacker can send a malicious signature and public key to trigger denial of service.
References
CVSS Scores
version 3.1