Junglewise Threat Intelligence
CVE-2024-30172: Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
CVE-2024-30172 · Severity: low · CVSS 3.1 · Published 2024-05-14
Technologies: BouncyCastle.Cryptography (NuGet), org.bouncycastle:bctls-jdk18on (Maven), org.bouncycastle:bcprov-jdk14 (Maven), org.bouncycastle:bctls-jdk14 (Maven), org.bouncycastle:bctls-jdk15to18 (Maven), org.bouncycastle:bcprov-jdk18on (Maven), org.bouncycastle:bcprov-jdk15to18 (Maven), BouncyCastle (NuGet). Vendors: NuGet, Maven.
Executive brief
Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
Affected products
- NuGet BouncyCastle.Cryptography
- Maven org.bouncycastle:bctls-jdk18on
- Maven org.bouncycastle:bcprov-jdk14
- Maven org.bouncycastle:bctls-jdk14
- Maven org.bouncycastle:bctls-jdk15to18
- Maven org.bouncycastle:bcprov-jdk18on
- Maven org.bouncycastle:bcprov-jdk15to18
- NuGet BouncyCastle