Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
An issue was discovered in Bouncy Castle Java Cryptography APIs starting in 1.73 and before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-30172US | — | — | ||
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030172WEB
- https://github.com/bcgit/bc-java/commit/1b9fd9b545e691bfb3941a9f6a797660c8860f02WEB
- https://github.com/bcgit/bc-java/commit/9c165791b68a204678b48ec11e4e579754c2ea49WEB
- https://github.com/bcgit/bc-java/commit/ebe1c75579170072dc59b8dee2b55ce31663178fWEB
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030172WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-30172ADVISORY
- https://security.netapp.com/advisory/ntap-20240614-0007WEB
- https://www.bouncycastle.org/latest_releases.htmlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan