Infinite loop in Bouncy Castle for Java - CVE-2024-30172

Vulnerability identifier: #VU89220

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-30172

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the Ed25519 verification code. A remote attacker can pass a specially signature and public key to the application, consume all available system resources and cause denial of service conditions.

Bouncy Castle for Java
IBM DB2
Keycloak
Crowd Server
DataPower Operations Dashboard
DB2 Data Management Console
DataStage on Cloud Pak for Data
Oracle Business Intelligence Enterprise Edition
IBM Business Automation Manager Open Editions
IBM OpenPages with Watson
Rational Performance Tester
webMethods Managed File Transfer
DevOps Test Performance
IBM Application Suite - IBM Asset Data Dictionary Component
Storage Defender - Resiliency Service
Storage Copy Data Management
Cloud Pak for Network Automation
PowerStore T
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Dell Policy Manager for Secure Connect Gateway (SCG)
IBM Secure External Authentication Server
Storage Protect Server
Maximo Application Suite - IoT Component
IBM Event Endpoint Management
Cognos Transformer
Robotic Process Automation for Cloud Pak
Robotic Process Automation Client for SaaS
Log Analysis
IBM Process Mining
IBM Cloud Transformation Advisor
IBM MQ Operator
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Knowledge Catalog in Cloud Pak for Data
Crowd Data Center
IBM Sterling B2B Integrator
IBM Spectrum Symphony
Confluence Data Center
WebSphere Remote Server
Bitbucket Data Center
Bamboo Server
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM Sterling Secure Proxy
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Observability with Instana
IBM App Connect for Manufacturing
IBM Disconnected Log Collector
JBoss Enterprise Application Platform
Bitbucket Server
Juniper Secure Analytics (JSA)
QRadar Suite
Confluence Server
IBM Cognos Controller
Dell Data Lakehouse
IBM License Metric Tool
Event Streams
Ubuntu
Anolis OS
eap7-netty-xnio-transport (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
bouncycastle (Ubuntu package)
bouncycastle-tls
bouncycastle-pkix
bouncycastle-pg
bouncycastle-mail
bouncycastle-jmail
bouncycastle-javadoc
bouncycastle
bouncycastle-util
eap7-bouncycastle (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jandex (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-netty (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)
Planning Analytics Local
watsonx.data
IBM Cloud Pak System
Red Hat Camel for Spring Boot

Install updates from vendor's website.

Bouncy Castle for Java - update to 1.78
Keycloak - update to 25.0.0
DataPower Operations Dashboard - update to 1.0.23.0
Log Analysis - update to 1.3.8
IBM Process Mining - update to 1.15.0
IBM Cloud Transformation Advisor - addressed in versions 3.10.0, 3.10.2
IBM MQ Operator - addressed in versions 9.3.0.20-r1, 9.4.0.0-r2
DB2 Data Management Console - update to 3.1.13.2
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
DataStage on Cloud Pak for Data - update to 5.2.1
Crowd Data Center - update to 5.2.6
Crowd Server - update to 5.2.6
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
JBoss Enterprise Application Platform - update to 7.4.18
IBM Spectrum Symphony - update to 7.3.2 FP3
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
Confluence Data Center - addressed in versions 7.19.26, 8.5.15, 8.9.4, 9.0.1
Confluence Server - addressed in versions 7.19.26, 8.5.15, 8.9.4, 9.0.1
IBM Business Automation Manager Open Editions - update to 8.0.7
Bitbucket Server - addressed in versions 8.9.14, 8.19.3
Bitbucket Data Center - addressed in versions 8.9.14, 8.19.3
Bamboo Server - addressed in versions 9.2.14, 9.5.4, 9.6.2
DevOps Test Performance - update to 11.0.7
IBM Cognos Controller - update to 11.0.1.0.3
eap7-netty-xnio-transport (Red Hat package) - addressed in versions 0.1.10-1.Final_redhat_00001.1.el7eap, 0.1.10-1.Final_redhat_00001.1.el8eap, 0.1.10-1.Final_redhat_00001.1.el9eap
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
eap7-log4j-jboss-logmanager (Red Hat package) - addressed in versions 1.3.1-1.Final_redhat_00002.1.el7eap, 1.3.1-1.Final_redhat_00002.1.el8eap, 1.3.1-1.Final_redhat_00002.1.el9eap
Dell Data Lakehouse - update to 1.4.0.0
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.17-1.Final_redhat_00001.1.el7eap, 1.5.17-1.Final_redhat_00001.1.el8eap, 1.5.17-1.Final_redhat_00001.1.el9eap
IBM Disconnected Log Collector - update to 1.8.6
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-37.Final_redhat_00037.1.el7eap, 1.10.0-37.Final_redhat_00037.1.el8eap, 1.10.0-37.Final_redhat_00037.1.el9eap
QRadar Suite - update to 1.10.22.0
bouncycastle (Ubuntu package) - addressed in versions 1.51-4ubuntu1+esm1, 1.59-1ubuntu0.1~esm1, 1.61-1ubuntu0.1~esm1, 1.68-5ubuntu0.1~esm1, 1.77-1ubuntu0.1~esm1
bouncycastle-tls - update to 1.78-1
bouncycastle-pkix - update to 1.78-1
bouncycastle-pg - update to 1.78-1
bouncycastle-mail - update to 1.78-1
bouncycastle-jmail - update to 1.78-1
bouncycastle-javadoc - update to 1.78-1
bouncycastle - update to 1.78-1
bouncycastle-util - update to 1.78-1
eap7-bouncycastle (Red Hat package) - addressed in versions 1.78.1-1.redhat_00002.1.el7eap, 1.78.1-1.redhat_00002.1.el8eap, 1.78.1-1.redhat_00002.1.el9eap
Planning Analytics Local - addressed in versions 2.0.0.99, 2.1.6
watsonx.data - update to 2.0.1
Storage Defender - Resiliency Service - update to 2.0.9
Storage Copy Data Management - update to 2.2.27.0
eap7-undertow (Red Hat package) - addressed in versions 2.2.33-1.SP1_redhat_00001.1.el7eap, 2.2.33-1.SP1_redhat_00001.1.el8eap, 2.2.33-1.SP1_redhat_00001.1.el9eap
IBM Cloud Pak System - update to 2.3.4.1
eap7-jandex (Red Hat package) - addressed in versions 2.4.5-1.Final_redhat_00001.1.el7eap, 2.4.5-1.Final_redhat_00001.1.el8eap, 2.4.5-1.Final_redhat_00001.1.el9eap
Cloud Pak for Network Automation - update to 2.7.5
eap7-hal-console (Red Hat package) - addressed in versions 3.3.23-1.Final_redhat_00001.1.el7eap, 3.3.23-1.Final_redhat_00001.1.el8eap, 3.3.23-1.Final_redhat_00001.1.el9eap
PowerStore T - update to 3.6.1.4-2413340
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.16-1.Final_redhat_00001.1.el7eap, 3.8.16-1.Final_redhat_00001.1.el8eap, 3.8.16-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.108-1.Final_redhat_00001.1.el7eap, 4.1.108-1.Final_redhat_00001.1.el8eap, 4.1.108-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.108-1.Final_redhat_00001.1.el7eap, 4.1.108-1.Final_redhat_00001.1.el8eap, 4.1.108-1.Final_redhat_00001.1.el9eap
Red Hat Camel for Spring Boot - update to 4.4.0
IBM Cloud Pak for Watson AIOps - update to 4.8.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.1
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.29-1.Final_redhat_00001.1.el7eap, 5.0.29-1.Final_redhat_00001.1.el8eap, 5.0.29-1.Final_redhat_00001.1.el9eap
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
Dell Secure Connect Gateway - update to 5.24.00.14
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.24.00.14
IBM Sterling Secure Proxy - addressed in versions 6.0.3.1, 6.1.0.1
IBM Secure External Authentication Server - addressed in versions 6.0.3.1, 6.1.0.2
eap7-wildfly (Red Hat package) - addressed in versions 7.4.18-1.GA_redhat_00001.1.el7eap, 7.4.18-1.GA_redhat_00001.1.el8eap, 7.4.18-1.GA_redhat_00001.1.el9eap
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.25
Maximo Application Suite - IoT Component - addressed in versions 8.7.15, 8.8.11, 9.0.0
IBM Maximo Application Suite - addressed in versions 8.10.19, 8.11.16, 9.0.4
IBM License Metric Tool - update to 9.2.36
IBM Security Verify Governance - update to 10.0.2.0.4
IBM Event Endpoint Management - update to 11.2.1
Cognos Transformer - addressed in versions 11.2.4 FP5, 12.0.4
Event Streams - update to 11.5.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
Robotic Process Automation for Cloud Pak - update to 21.0.7.18
IBM Robotic Process Automation - update to 21.0.7.18
Robotic Process Automation Client for SaaS - update to 21.0.7.18
IBM Observability with Instana - update to 273

• https://www.bouncycastle.org/releasenotes.html#1.78

• Multiple vulnerabilities in Bouncy Castle Crypto Package For Java
• Multiple vulnerabilities in Keycloak
• Multiple vulnerabilities in IBM Instana Observability
• Multiple vulnerabilities in Dell Secure Connect Gateway Policy Manager
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in IBM License Metric Tool
• Infinite loop in IBM Process Mining
• Multiple vulnerabilities in IBM App Connect for Manufacturing
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4
• Multiple vulnerabilities in IBM Log Analysis
• Multiple vulnerabilities in IBM QRadar Suite Software
• Infinite loop in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Event Endpoint Management
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Infinite loop in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Multiple vulnerabilities in IBM Robotic Process Automation
• Multiple vulnerabilities in IBM Secure External Authentication Server
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM OpenPages with Watson
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• IBM Sterling B2B Integrator update for Bouncy Castle
• Confluence Data Center and Server update for org.bouncycastle:bcprov-jdk18on
• Crowd Data Center and Server update for org.bouncycastle:bcprov-jdk18on
• Bitbucket Data Center and Server update for bcprov-jdk18on
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Cognos Controller
• Bamboo Data Center and Server update for Bouncy Castle
• Multiple vulnerabilities in IBM Planning Analytics
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Storage Protect Server
• IBM Cognos Transformer update for Bouncy Castle
• Multiple vulnerabilities in Dell PowerStore T
• IBM watsonx.data update for Bouncy Castle Crypto Package For Java
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Asset Data Dictionary Component
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Bouncy Castle Crypto Package For Java
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Dell Data Lakehouse update for third-party components
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Knowledge Catalog for IBM Cloud Pak for Data
• IBM DataPower Operations Dashboard update for Bouncy Castle Crypto Package For Java
• Anolis OS update for bouncycastle
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Rational Performance Tester
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Ubuntu update for bouncycastle