CVE-2024-29857 Security Details

CVE ID

CVE-2024-29857

CWE

CWE-125

CVE Description

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.

Published

Apr 10, 2024

CVSS Score & Severity

7.5High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.252%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

Org.BouncyCastle.Math.Field.IFiniteField Org.BouncyCastle.Math.EC.AbstractF2mCurve::BuildField(System.Int32,System.Int32,System.Int32,System.Int32)

DOTNETVulnerable params: 0

org/bouncycastle/math/ec/ECCurve$AbstractF2m.solveQuadraticEquation(Lorg/bouncycastle/math/ec/ECFieldElement;)Lorg/bouncycastle/math/ec/ECFieldElement;

JVM

org/bouncycastle/math/ec/ECCurve$F2m.solveQuadradicEquation(Lorg/bouncycastle/math/ec/ECFieldElement;)Lorg/bouncycastle/math/ec/ECFieldElement;

JVM

org/bouncycastle/math/ec/ECCurve$F2m.solveQuadraticEquation(Lorg/bouncycastle/math/ec/ECFieldElement;)Lorg/bouncycastle/math/ec/ECFieldElement;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

bouncycastle.orgPROJECT

GitHub · Advisory · GHSA-8xfc-gm6g-vgpvTHIRD_PARTY