LDAP injection in Bouncy Castle for Java - CVE-2023-33201

Vulnerability identifier: #VU78328

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2023-33201

CWE-ID: CWE-90

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Bouncy Castle for Java
IBM Global High Availability Mailbox
Log Analysis
Oracle Banking Party Management
IBM Sterling Control Center
Oracle Financial Services Model Management and Governance
Oracle Communications Session Report Manager
Enterprise Manager Base Platform
Oracle Banking APIs
Oracle Communications Cloud Native Core Network Repository Function
Splunk AppDynamics Database Agent
Oracle Communications EAGLE Element Management System
IBM Process Mining
Cryostat
IBM Cloud Transformation Advisor
IBM Cloud Object Storage Systems
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
IBM Observability with Instana
Amazon Linux AMI
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
Oracle Solaris Cluster
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
Analytics Content Hub
Dell Policy Manager for Secure Connect Gateway (SCG)
webMethods Managed File Transfer
Oracle Financial Services Lending and Leasing
Oracle Banking Digital Experience
IBM Application Suite - IBM Asset Data Dictionary Component
IBM Watson Machine Learning Accelerator
IBM i Modernization Engine for Lifecycle Integration
Storage Copy Data Management
Cloud Pak for Network Automation
IBM Cloud Pak for Watson AIOps
Daeja ViewONE
IBM Business Automation Manager Open Editions
Maximo Application Suite - IoT Component
Security Verify Privilege On-Premises
AMQ Streams
JBoss Enterprise Application Platform
AMQ Broker
Oracle WebLogic Server
Fuse
Oracle Financial Services Revenue Management and Billing
Oracle WebCenter Portal
Siebel CRM Integration
Oracle Utilities Application Framework
Oracle Communications Element Manager
Oracle WebCenter Sites
Oracle Managed File Transfer
Oracle SOA Suite
Oracle Banking Supply Chain Finance
Oracle Banking Trade Finance Process Management
Oracle Banking Liquidity Management
Oracle Banking Credit Facilities Process Management
Oracle Banking Extensibility Workbench
Oracle Banking Branch
Oracle Banking Cash Management
Oracle Banking Electronic Data Exchange for Corporates
Oracle Banking Origination
Oracle Banking Corporate Lending Process Management
Oracle Banking Virtual Account Management
IBM Data Risk Manager
Oracle Utilties Application Framework
Red Hat Camel for Spring Boot
Communications Service Catalog and Design
Oracle Communications Instant Messaging Server
Juniper Secure Analytics (JSA)
IBM App Connect Professional
IBM Disconnected Log Collector
IBM App Connect for Manufacturing
IBM Watson Explorer Foundational Components
IBM Watson Explorer Deep Analytics Edition Foundational Components
Red Hat Single Sign-On
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
JD Edwards EnterpriseOne Orchestrator
IBM Security Guardium
Oracle Commerce Guided Search
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Oracle Communications Cloud Native Core Service Communication Proxy
eap7 (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-jboss-modules (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
bouncycastle (Ubuntu package)
bouncycastle
bouncycastle-javadoc
bouncycastle-mail
bouncycastle-pg
bouncycastle-pkix
bouncycastle-tls
bouncycastle-util
bouncycastle-jmail
eap7-bouncycastle (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
eap7-undertow (Red Hat package)
eap7-activemq-artemis (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-netty (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
IBM Storage Scale System
IBM InfoSphere Information Server

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper input validation in applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability. A remote non-authenticated attacker can use a specially crafted X.509 certificate to bypass authentication process and gain unauthorized access to the application.

Install updates from vendor's website.

• https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc
• https://github.com/bcgit/bc-java/wiki/CVE-2023-33201
• https://bouncycastle.org