PkgSeer

Vulnerability GHSA-9pwp-9qqc-pr26

Critical

1 month ago

Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

2.0.0 - 2.0.1

Summary

Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

Details

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.

2.0.0 - 2.0.1 GHSA-98j2-6v39-78w8

Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound

>=2.1.0 <2.1.3 GHSA-v6w3-qrh8-qccc

Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

1.71.0 - 1.80.0 and 1.80.2 - 1.84.0 GHSA-qp49-qgx5-5m26

Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

1.71.0 - 1.80.0 and 1.80.2 - 1.84.0 GHSA-qp49-qgx5-5m26

Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

1.71.0 - 1.80.0 and 1.80.2 - 1.84.0 GHSA-qp49-qgx5-5m26

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

1 month ago

Fixed (1.0.2.7)

Unknown

Fixed (2.0.2)

Unknown

Fixed (2.1.3)

Unknown

Fixed (1.85)

Unknown

Fixed (1.85)

Unknown

Fixed (2.73.12)

Unknown

Last Modified

9 days ago