bouncycastle vulnerabilities (SUSE)
50 vulnerabilities.
bouncycastleSUSEMLS external commit can remove an arbitrary group member8.7 HighbouncycastleSUSEBLS12-381 key validation accepts a public key built on a foreign curve7.1 HighbouncycastleSUSEHQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler5.9 MediumbouncycastleSUSEMLS X.509 credential not bound to the LeafNode signature key9.2 CriticalbouncycastleSUSEOpenPGP certification accepted from a subkey without certification authority8.2 HighbouncycastleSUSEOpenPGP data signature accepted from a signing subkey without cross-certification8.2 HighbouncycastleSUSECMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent8.7 HighbouncycastleSUSEPKIXCertPathReviewer does not apply X.509 name constraints to the target certificate8.7 HighbouncycastleSUSECMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys6.9 MediumbouncycastleSUSEOpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check8.2 HighbouncycastleSUSELegacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider5.3 MediumbouncycastleSUSENTRU leaks private key information by reducing secret values with a non-constant-time integer division8.2 HighbouncycastleSUSEPassword-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points5.3 MediumbouncycastleSUSEMLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender8.7 HighbouncycastleSUSEPKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)5.3 MediumbouncycastleSUSELazy ASN.1 sequence forcing resets nesting-depth guard8.7 HighbouncycastleSUSERSA PKCS#1 verification skips last two hash bytes in NULL-omitted path8.7 HighbouncycastleSUSEMLS wire decoder allocates attacker-declared opaque length before bounds check8.7 HighbouncycastleSUSEOpenPGP AEAD decryption skips final tag on chunk-aligned data8.7 HighbouncycastleSUSEIESEngine stream-mode MAC forgery via length-dependent KDF split8.7 HighbouncycastleSUSEKCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)8.7 HighbouncycastleSUSECMS AuthEnvelopedData fails to enforce tag-length on decryption8.7 HighbouncycastleSUSEPossible OOM from unbounded up-front allocation on a definite-length read8.7 HighbouncycastleSUSEQuadratic-time escaping when stringifying X.500 distinguished names8.7 HighbouncycastleSUSEHSS public-key level count unbounded, enabling huge allocation on verify8.7 HighbouncycastleSUSECCM-family modes write plaintext to caller buffer before tag check8.7 HighbouncycastleSUSEStapled OCSP response accepted without binding to the checked certificate9.3 CriticalbouncycastleSUSEBCFKS keystore load honours unbounded KDF cost from untrusted file5.3 MediumbouncycastleSUSEJSSE hostname verifier CN-fallback enabled by default despite documented opt-in9.3 CriticalbouncycastleSUSECMS verifySignatures returns true for SignedData with zero signers8.7 HighbouncycastleSUSEOpenPGP CFB quick-check oracle active on symmetric/session-key paths8.7 HighbouncycastleSUSES/MIME validator trusts signer-asserted signingTime for path validation8.7 HighbouncycastleSUSECMS AuthenticatedData content not bound to MAC when authAttrs present8.7 HighbouncycastleSUSEOpenPGP inline-signature policy failures silently ignored8.7 HighbouncycastleSUSEMLS hash-ratchet honours arbitrary 32-bit generation counter from sender8.7 HighbouncycastleSUSEOER parser recurses without depth limit on self-referential IEEE 1609.2 schema8.7 HighbouncycastleSUSEDTLS handshake reassembler allocates buffer from unchecked 24-bit length8.7 HighbouncycastleSUSECRMF/CMP password-MAC honours unbounded iteration count6.9 MediumbouncycastleSUSEOpenPGP Argon2 S2K honours attacker-chosen memory and passes6.9 MediumbouncycastleSUSEOpenPGP user-attribute subpacket length bounded only by JVM max memory8.7 HighbouncycastleSUSEMTI/A0 DH agreement exponentiates unvalidated peer value9.3 CriticalbouncycastleSUSEBKS keystore accepts legacy version with 16-bit integrity MAC key7.1 HighbouncycastleSUSELDAP filter injection in legacy jdk1.4 LDAPStoreHelper6.9 MediumbouncycastleSUSEBKS/UBER keystore allocates from untrusted lengths before integrity check7.1 HighbouncycastleSUSEName Constraints bypass via trailing dot in rfc822Name and URI9.3 CriticalbouncycastleSUSEPKCS#8 / PBES2 decryptors honour unbounded KDF cost from input5.3 MediumbouncycastleSUSEBouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")5.9 MediumbouncycastleSUSEPrefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin5.9 MediumbouncycastleSUSEBouncy Castle For Java LDAP injection vulnerability5.3 MediumbouncycastleSUSETiming based private key exposure in Bouncy Castle5.9 Medium