Insufficient verification of data authenticity in Bouncy Castle for Java - CVE-2024-34447

Vulnerability identifier: #VU89221

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-34447

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to hostname verification is performed against a DNS-resolved IP address when endpoint identification is enabled in the BCJSSE and an SSL socket is not created with an explicit hostname. A remote attacker can bypass implemented security restrictions.

Bouncy Castle for Java
Amazon Linux AMI
Ubuntu
Log Analysis
IBM Process Mining
IBM Cloud Transformation Advisor
IBM MQ Operator
IBM Spectrum Symphony
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Watson Query on Cloud Pak for Data
Cloud Pak for Network Automation
DataStage on Cloud Pak for Data
Rational Performance Tester
DevOps Test Performance
Storage Defender - Resiliency Service
Storage Copy Data Management
IBM Cloud Pak for Watson AIOps
Cognos Transformer
bouncycastle (Ubuntu package)
bouncycastle
Planning Analytics Local

Install updates from vendor's website.

Bouncy Castle for Java - update to 1.78
Log Analysis - update to 1.3.8
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 3.2.0
Watson Query on Cloud Pak for Data - update to 3.2.0
IBM Process Mining - update to 1.15.0
IBM Cloud Transformation Advisor - update to 3.10.2
IBM MQ Operator - addressed in versions 9.3.0.20-r1, 9.4.0.0-r2
Cloud Pak for Network Automation - update to 2.7.4
DataStage on Cloud Pak for Data - update to 5.2.1
IBM Spectrum Symphony - update to 7.3.2 FP3
DevOps Test Performance - update to 11.0.7
bouncycastle (Ubuntu package) - addressed in versions 1.51-4ubuntu1+esm1, 1.59-1ubuntu0.1~esm1, 1.61-1ubuntu0.1~esm1, 1.68-5ubuntu0.1~esm1, 1.77-1ubuntu0.1~esm1
bouncycastle - update to 1.70-4
Planning Analytics Local - addressed in versions 2.0.0.99, 2.1.6
Storage Defender - Resiliency Service - update to 2.0.9
Storage Copy Data Management - update to 2.2.27.0
IBM Cloud Pak for Watson AIOps - update to 4.6.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.1
Cognos Transformer - addressed in versions 11.2.4 FP5, 12.0.4

• https://www.bouncycastle.org/releasenotes.html#1.78

• Multiple vulnerabilities in Bouncy Castle Crypto Package For Java
• Insufficient verification of data authenticity in insufficient verification of data authenticity
• Multiple vulnerabilities in IBM Log Analysis
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Amazon Linux AMI update for bouncycastle
• Insufficient verification of data authenticity in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Planning Analytics
• IBM Cognos Transformer update for Bouncy Castle
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Data Virtualization on Cloud Pak for Data
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Rational Performance Tester
• Ubuntu update for bouncycastle