Resource exhaustion in Bouncy Castle for Java - CVE-2024-29857

Vulnerability identifier: #VU89218

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-29857

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to library does not properly control consumption of internal resources when importing an EC certificate with specially crafted F2m parameters. A remote attacker can pass a specially crafted certificate to the application to trigger resource exhaustion and perform a denial of service (DoS) attack.

Bouncy Castle for Java
IBM DB2
Amazon Linux AMI
Ubuntu
Anolis OS
Keycloak
Crowd Server
DataPower Operations Dashboard
DataStax Hyper-Converged Database
DataStage on Cloud Pak for Data
IBM OpenPages with Watson
Rational Performance Tester
webMethods Managed File Transfer
DevOps Test Performance
IBM Application Suite - IBM Asset Data Dictionary Component
Storage Defender - Resiliency Service
Storage Copy Data Management
Cloud Pak for Network Automation
PowerStore T
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Storage Protect Server
Maximo Application Suite - IoT Component
IBM Event Endpoint Management
Cognos Transformer
Robotic Process Automation for Cloud Pak
Robotic Process Automation Client for SaaS
Log Analysis
IBM Process Mining
IBM Cloud Transformation Advisor
IBM MQ Operator
Splunk DB Connect
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Knowledge Catalog in Cloud Pak for Data
Crowd Data Center
IBM Sterling B2B Integrator
IBM Spectrum Symphony
Confluence Data Center
Bitbucket Data Center
WebSphere Remote Server
Bamboo Server
Enterprise Manager Base Platform
Oracle Communications Cloud Native Core Network Repository Function
Splunk AppDynamics Database Agent
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Sterling Secure Proxy
IBM Sterling External Authentication Server
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Observability with Instana
IBM App Connect for Manufacturing
IBM Disconnected Log Collector
Oracle Utilities Application Framework
Oracle Global Lifecycle Management NextGen OUI Framework
Oracle SOA Suite
JBoss Enterprise Application Platform
Bitbucket Server
Oracle WebLogic Server
Juniper Secure Analytics (JSA)
QRadar Suite
Confluence Server
RSA Authentication Manager
IBM Cognos Controller
IBM License Metric Tool
Event Streams
eap7-netty-xnio-transport (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
bouncycastle (Ubuntu package)
bouncycastle
bouncycastle-pkix
bouncycastle-tls
bouncycastle-pg
bouncycastle-mail
bouncycastle-util
bouncycastle-jmail
bouncycastle-javadoc
eap7-bouncycastle (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jandex (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-netty (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)
Planning Analytics Local
IBM Cloud Pak System
Red Hat Camel for Spring Boot
IBM Storage Scale System
IBM Security Guardium

Install updates from vendor's website.

Bouncy Castle for Java - update to 1.78
Keycloak - update to 25.0.0
DataPower Operations Dashboard - update to 1.0.23.0
DataStax Hyper-Converged Database - update to 1.2.5
Log Analysis - update to 1.3.8
IBM Process Mining - update to 1.15.0
IBM Cloud Transformation Advisor - update to 3.10.2
IBM MQ Operator - addressed in versions 9.3.0.20-r1, 9.4.0.0-r2
Splunk DB Connect - update to 4.0.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
Crowd Data Center - addressed in versions 5.2.6, 5.3.2
Crowd Server - update to 5.2.6
DataStage on Cloud Pak for Data - update to 5.2.1
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
JBoss Enterprise Application Platform - update to 7.4.18
IBM Spectrum Symphony - update to 7.3.2 FP3
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
Confluence Data Center - addressed in versions 7.19.26, 8.5.12, 8.9.4
Confluence Server - addressed in versions 7.19.26, 8.5.12
Bitbucket Data Center - addressed in versions 8.9.24, 8.19.14
Bitbucket Server - addressed in versions 8.9.24, 8.19.14
RSA Authentication Manager - update to 8.7 SP2 Patch 6
Bamboo Server - addressed in versions 9.2.14, 9.5.4, 9.6.2
DevOps Test Performance - update to 11.0.7
IBM Cognos Controller - update to 11.0.1.0.3
Splunk AppDynamics Database Agent - update to 26.1.0
eap7-netty-xnio-transport (Red Hat package) - addressed in versions 0.1.10-1.Final_redhat_00001.1.el7eap, 0.1.10-1.Final_redhat_00001.1.el8eap, 0.1.10-1.Final_redhat_00001.1.el9eap
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
eap7-log4j-jboss-logmanager (Red Hat package) - addressed in versions 1.3.1-1.Final_redhat_00002.1.el7eap, 1.3.1-1.Final_redhat_00002.1.el8eap, 1.3.1-1.Final_redhat_00002.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.17-1.Final_redhat_00001.1.el7eap, 1.5.17-1.Final_redhat_00001.1.el8eap, 1.5.17-1.Final_redhat_00001.1.el9eap
IBM Disconnected Log Collector - update to 1.8.6
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-37.Final_redhat_00037.1.el7eap, 1.10.0-37.Final_redhat_00037.1.el8eap, 1.10.0-37.Final_redhat_00037.1.el9eap
QRadar Suite - update to 1.10.22.0
bouncycastle (Ubuntu package) - addressed in versions 1.51-4ubuntu1+esm1, 1.59-1ubuntu0.1~esm1, 1.61-1ubuntu0.1~esm1, 1.68-5ubuntu0.1~esm1, 1.77-1ubuntu0.1~esm1
bouncycastle - update to 1.70-4
bouncycastle-pkix - update to 1.78-1
bouncycastle-tls - update to 1.78-1
bouncycastle-pg - update to 1.78-1
bouncycastle-mail - update to 1.78-1
bouncycastle - update to 1.78-1
bouncycastle-util - update to 1.78-1
bouncycastle-jmail - update to 1.78-1
bouncycastle-javadoc - update to 1.78-1
eap7-bouncycastle (Red Hat package) - addressed in versions 1.78.1-1.redhat_00002.1.el7eap, 1.78.1-1.redhat_00002.1.el8eap, 1.78.1-1.redhat_00002.1.el9eap
Planning Analytics Local - addressed in versions 2.0.0.99, 2.1.6
Storage Defender - Resiliency Service - update to 2.0.9
Storage Copy Data Management - update to 2.2.27.0
eap7-undertow (Red Hat package) - addressed in versions 2.2.33-1.SP1_redhat_00001.1.el7eap, 2.2.33-1.SP1_redhat_00001.1.el8eap, 2.2.33-1.SP1_redhat_00001.1.el9eap
IBM Cloud Pak System - update to 2.3.4.1
eap7-jandex (Red Hat package) - addressed in versions 2.4.5-1.Final_redhat_00001.1.el7eap, 2.4.5-1.Final_redhat_00001.1.el8eap, 2.4.5-1.Final_redhat_00001.1.el9eap
Cloud Pak for Network Automation - update to 2.7.5
eap7-hal-console (Red Hat package) - addressed in versions 3.3.23-1.Final_redhat_00001.1.el7eap, 3.3.23-1.Final_redhat_00001.1.el8eap, 3.3.23-1.Final_redhat_00001.1.el9eap
PowerStore T - update to 3.6.1.4-2413340
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.16-1.Final_redhat_00001.1.el7eap, 3.8.16-1.Final_redhat_00001.1.el8eap, 3.8.16-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.108-1.Final_redhat_00001.1.el7eap, 4.1.108-1.Final_redhat_00001.1.el8eap, 4.1.108-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.108-1.Final_redhat_00001.1.el7eap, 4.1.108-1.Final_redhat_00001.1.el8eap, 4.1.108-1.Final_redhat_00001.1.el9eap
Red Hat Camel for Spring Boot - update to 4.4.0
IBM Cloud Pak for Watson AIOps - update to 4.8.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.1
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.29-1.Final_redhat_00001.1.el7eap, 5.0.29-1.Final_redhat_00001.1.el8eap, 5.0.29-1.Final_redhat_00001.1.el9eap
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
IBM Storage Scale System - addressed in versions 5.1.9.5, 5.2.1.0
IBM Sterling Secure Proxy - addressed in versions 6.1.0.1 iFix 02, 6.2.0.1 iFix 01
IBM Sterling External Authentication Server - update to 6.1.0.2 iFix 02
eap7-wildfly (Red Hat package) - addressed in versions 7.4.18-1.GA_redhat_00001.1.el7eap, 7.4.18-1.GA_redhat_00001.1.el8eap, 7.4.18-1.GA_redhat_00001.1.el9eap
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.25
Maximo Application Suite - IoT Component - addressed in versions 8.7.12, 8.8.8, 9.0.0
IBM Maximo Application Suite - addressed in versions 8.10.19, 8.11.16, 9.0.4
IBM License Metric Tool - update to 9.2.36
IBM Security Verify Governance - update to 10.0.2.0.4
IBM Security Guardium - addressed in versions 11.0 p6509, 12.0 p6009
IBM Event Endpoint Management - update to 11.2.1
Cognos Transformer - addressed in versions 11.2.4 FP5, 12.0.4
Event Streams - update to 11.5.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
IBM Robotic Process Automation - update to 21.0.7.18
Robotic Process Automation for Cloud Pak - update to 21.0.7.18
Robotic Process Automation Client for SaaS - update to 21.0.7.18
IBM Observability with Instana - update to 273

• https://www.bouncycastle.org/releasenotes.html#1.78

• Multiple vulnerabilities in Bouncy Castle Crypto Package For Java
• Multiple vulnerabilities in Keycloak
• Multiple vulnerabilities in IBM Instana Observability
• Multiple vulnerabilities in IBM License Metric Tool
• Resource exhaustion in IBM Process Mining
• Multiple vulnerabilities in IBM App Connect for Manufacturing
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
• Multiple vulnerabilities in IBM Log Analysis
• Multiple vulnerabilities in Oracle Global Lifecycle Management NextGen OUI Framework
• Multiple vulnerabilities in Oracle Utilities Application Framework
• Multiple vulnerabilities in IBM QRadar Suite Software
• Amazon Linux AMI update for bouncycastle
• Multiple vulnerabilities in IBM Event Endpoint Management
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Bamboo Data Center and Server update for Bouncy Castle Crypto Package For Java
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Resource exhaustion in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 
• Multiple vulnerabilities in IBM Storage Scale
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Resource exhaustion in IBM Maximo Application Suite - IoT Component
• Confluence Data Center and Server update for bcprov-jdk18on
• Crowd Data Center and Server update for bcprov-jdk18on
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Multiple vulnerabilities in IBM Robotic Process Automation
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in IBM OpenPages with Watson
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• IBM Sterling B2B Integrator update for Bouncy Castle
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Planning Analytics
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Storage Protect Server
• IBM Cognos Transformer update for Bouncy Castle
• Multiple vulnerabilities in Dell PowerStore T
• Multiple vulnerabilities in Oracle WebLogic Server
• Resource exhaustion in Enterprise Manager Base Platform
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Asset Data Dictionary Component
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Bouncy Castle Crypto Package For Java
• IBM Sterling External Authentication Server update for Bouncy Castle Crypto Package For Java
• IBM Sterling Secure Proxy update for Bouncy Castle Crypto Package For Java
• Bitbucket Data Center and Server update for bcprov-jdk18on
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in Oracle SOA Suite
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Splunk DB Connect update for third-party components
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• Splunk DB Connect update for third-party components
• Resource exhaustion in IBM DataPower Operations Dashboard
• Anolis OS update for bouncycastle
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Rational Performance Tester
• Splunk AppDynamics Database Agent update for third-party components
• Ubuntu update for bouncycastle
• Multiple vulnerabilities in Oracle SOA Suite
• Multiple vulnerabilities in IBM DataStax Hyper-Converged Database