CVE-2024-29857: Input Validation
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.
Other sources
The Bouncy Castle Crypto Package For Java is vulnerable to a denial of service, caused by improper input validation. By importing an EC certificate with crafted F2m parameters, a remote attacker could exploit this vulnerability to cause excessive CPU consumption.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29857?
CVE-2024-29857 is classified as a security vulnerability that can lead to excessive CPU consumption.
How do I fix CVE-2024-29857?
To fix CVE-2024-29857, upgrade Bouncy Castle Java to version 1.78 or later, or for .NET versions, upgrade to BouncyCastle.Cryptography version 2.3.1 or later.
Which versions of Bouncy Castle are affected by CVE-2024-29857?
CVE-2024-29857 affects Bouncy Castle Java before version 1.78, BC-FJA before version 1.0.2.5, and Bouncy Castle C# .Net before version 2.3.1.
What products are impacted by CVE-2024-29857?
CVE-2024-29857 impacts Bouncy Castle libraries in several frameworks including Java, .NET, and specific IBM products like Security Verify Governance.
Is there a workaround for CVE-2024-29857?
There is no documented workaround for CVE-2024-29857; upgrading to the latest versions is the recommended action.