CVE-2023-33202: Medium severity bouncycastle Bouncy Castle for Java vulnerability
Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file that has crafted ASN.1 data through the PEMParser causes an OutOfMemoryError, which can enable a denial of service attack.
Other sources
Bouncy Castle for Java is vulnerable to a denial of service, caused by a flaw in the org.bouncycastle.openssl.PEMParser class. By sending a specially crafted file, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-33202.
What is the severity of CVE-2023-33202?
The severity of CVE-2023-33202 is high with a CVSS score of 7.5.
What is the affected software?
The affected software is Bouncy Castle for Java before version 1.73.
What is the impact of this vulnerability?
This vulnerability can lead to a Denial of Service (DoS) attack by parsing a crafted file.
How can I fix CVE-2023-33202?
To fix CVE-2023-33202, update Bouncy Castle for Java to version 1.73 or later.