CVE-2024-30172: High severity maven/org.bouncycastle:bctls-jdk15to18 vulnerability
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.
Other sources
An issue was discovered in Bouncy Castle Java Cryptography APIs starting in 1.73 and before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.
— GitHub
The Bouncy Castle Crypto Package For Java is vulnerable to a denial of service, caused by an infinite loop in the Ed25519 verification code. By persuading a victim to use a specially crafted signature and public key, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30172?
CVE-2024-30172 is considered a high severity vulnerability due to its potential to cause denial of service via an infinite loop.
How do I fix CVE-2024-30172?
To fix CVE-2024-30172, upgrade to Bouncy Castle Java Cryptography APIs version 1.78 or later.
What software is affected by CVE-2024-30172?
CVE-2024-30172 affects multiple Bouncy Castle packages and versions prior to 1.78.
What kind of issue is described in CVE-2024-30172?
CVE-2024-30172 involves an infinite loop issue in Ed25519 verification due to crafted signatures and public keys.
Can CVE-2024-30172 be exploited remotely?
Yes, the infinite loop vulnerability in CVE-2024-30172 can potentially be exploited remotely by delivering a malicious signature.