Memory leak in Bouncy Castle for Java - CVE-2019-17359

Vulnerability identifier: #VU22272

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-17359

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in the ASN.1 parser. A remote attacker can send a specially crafted ASN.1 data and cause an OutOfMemoryError and perform denial of service attack.

Bouncy Castle for Java
Oracle Communications Convergence
Oracle Hospitality Guest Access
Oracle Communications Session Route Manager
Oracle Business Process Management Suite
Oracle Managed File Transfer
Oracle SOA Suite
Integrated Diameter Intelligence Hub (IDIH)
Oracle Financial Services Analytical Applications Infrastructure
Oracle FLEXCUBE Private Banking
Oracle Data Integrator
Oracle Retail Xstore Point of Service
PeopleSoft Enterprise PeopleTools
Oracle WebCenter Portal
Oracle WebLogic Server
IBM Cloud Application Performance Management (APM)
IBM Observability with Instana

Install updates from vendor's website.

Bouncy Castle for Java - update to 1.64
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
IBM Observability with Instana - update to 269

• https://www.bouncycastle.org/latest_releases.html
• https://www.bouncycastle.org/releasenotes.html

• Denial of service in Bouncy Castle
• Multiple vulnerabilities in Oracle WebLogic Server
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Memory leak in Oracle SOA Suite
• Memory leak in Oracle Managed File Transfer
• Multiple vulnerabilities in Oracle WebCenter Portal
• Memory leak in Oracle Hospitality Guest Access
• Memory leak in Oracle Communications Convergence
• Multiple vulnerabilities in Oracle FLEXCUBE Private Banking
• Memory leak in Oracle Business Process Management Suite
• Multiple vulnerabilities in Integrated Diameter Intelligence Hub (IDIH)
• Multiple vulnerabilities in Oracle Communications Session Route Manager
• Multiple vulnerabilities in Oracle Data Integrator
• Multiple vulnerabilities in IBM Application Performance Management products
• Multiple vulnerabilities in IBM Observability with Instana