CVE-2024-34447: High severity IBM Planning Analytics vulnerability
An issue was discovered in Bouncy Castle Java Cryptography APIs before BC 1.78. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
https://www.bouncycastle.org/latestreleases.html
Other sources
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
— MITRE
The Bouncy Castle Crypto Package For Java could allow a remote attacker to bypass security restrictions, caused by a flaw when endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname. By sending a specially crafted request, an attacker could exploit this vulnerability to perform DNS poisoning attack.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34447?
CVE-2024-34447 has a high severity due to potential vulnerabilities in SSL socket communication when hostname verification is inadequate.
How do I fix CVE-2024-34447?
To fix CVE-2024-34447, upgrade to Bouncy Castle version 1.78 or later.
Which versions of Bouncy Castle are affected by CVE-2024-34447?
CVE-2024-34447 affects Bouncy Castle Java Cryptography APIs versions prior to 1.78.
What impact does CVE-2024-34447 have on applications?
CVE-2024-34447 may allow an attacker to perform man-in-the-middle attacks if hostname verification fails.
Is CVE-2024-34447 specific to certain software vendors?
CVE-2024-34447 affects various packages under Bouncy Castle, including those used in IBM Planning Analytics.