GHSA-4h8f-2wvx-gg5w

Source

https://github.com/advisories/GHSA-4h8f-2wvx-gg5w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-4h8f-2wvx-gg5w/GHSA-4h8f-2wvx-gg5w.json

Aliases

• CVE-2024-34447

Published

2024-05-03T18:30:37Z

Modified

2024-05-14T20:06:13.945978Z

Summary

Bouncy Castle Java Cryptography API vulnerable to DNS poisoning

Details

An issue was discovered in Bouncy Castle Java Cryptography APIs before BC 1.78. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-34447
• https://github.com/bcgit/bc-java/issues/1656
• https://github.com/bcgit/bc-java
• https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447
• https://www.bouncycastle.org/latest_releases.html