CVE-2019-17359GHSA-2MH8-GX2M-MR75
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.64
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- org.bouncycastle:bcprov-jdk14Maven
From 1.63 · fixed in 1.64
References 16
lists.apache.org
- thread.html/r467ade3fef3493f1fff1a68a256d087874e1f858ad1de7a49fe05d27@<commits.tomee.apache.org>
- thread.html/r4d475dcaf4f57115fa57d8e06c3823ca398b35468429e7946ebaefdc@<commits.tomee.apache.org>
- thread.html/r16c3a90cb35ae8a9c74fd5c813c16d6ac255709c9f9d71cd409e007d@<commits.tomee.apache.org>
- thread.html/r02f887807a49cfd1f1ad53f7a61f3f8e12f60ba2c930bec163031209@<commits.tomee.apache.org>
- thread.html/r91b07985b1307390a58c5b9707f0b28ef8e9c9e1c86670459f20d601@<commits.tomee.apache.org>
- thread.html/re60f980c092ada4bfe236dcfef8b6ca3e8f3b150fc0f51b8cc13d59d@<commits.tomee.apache.org>
- thread.html/r8ecb5b76347f84b6e3c693f980dbbead88c25f77b815053c4e6f2c30@<commits.tomee.apache.org>
- thread.html/r79b6a6aa0dd1aeb57bd253d94794bc96f1ec005953c4bd5414cc0db0@<commits.tomee.apache.org>