Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2024-30172

An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.

VectorNETWORK

PublishedMay 14, 2024, 15:21

Published Bycve@mitre.org

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.bouncycastle:bcprov-jdk18on(Maven)1.731.78N/A

org.bouncycastle:bcprov-jdk15to18(Maven)1.731.78N/A

org.bouncycastle:bcprov-jdk14(Maven)1.731.78N/A

org.bouncycastle:bctls-jdk18on(Maven)1.731.78N/A

org.bouncycastle:bctls-jdk14(Maven)1.731.78N/A

org.bouncycastle:bctls-jdk15to18(Maven)1.731.78N/A

BouncyCastle(NuGet)0N/AN/A

BouncyCastle.Cryptography(NuGet)02.3.1N/A

References

https://security.netapp.com/advisory/ntap-20240614-0007/
https://www.bouncycastle.org/latest_releases.html

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK