Skip to main content

Allocation of Resources Without Limits or Throttling in org.bouncycastle:bcprov-debug-jdk14

CVE-2019-17359

  • org.bouncycastle:bcprov-debug-jdk14
  • org.bouncycastle:bcprov-debug-jdk15on
  • org.bouncycastle:bcprov-ext-jdk14
  • org.bouncycastle:bcprov-ext-jdk15on
  • org.bouncycastle:bcprov-jdk14
  • org.bouncycastle:bcprov-jdk15on
  • org.bouncycastle:bcprov-jdk15to18
High
7.5/10

Summary

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) before 1.64 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published