Vulnerability identifier: #VU89220
Vulnerability risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID:
CWE-ID:
CWE-835
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
The Bouncy Castle Crypto Package For Java
Universal components / Libraries /
Libraries used by multiple products
Vendor: Legion of the Bouncy Castle Inc.
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the Ed25519 verification code. A remote attacker can pass a specially signature and public key to the application, consume all available system resources and cause denial of service conditions.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
The Bouncy Castle Crypto Package For Java: 1.0 - 1.77
External links
http://www.bouncycastle.org/releasenotes.html#1.78
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.