GHSA-m44j-cfrm-g8qc: BouncyCastle.Cryptography fixed in 2.3.1

GHSA-m44j-cfrm-g8qc PUBLISHED CVSS 5.300000190734863 MEDIUM

Bouncy Castle crafted signature and public key can be used to trigger an infinite loop

Record from GitHub Advisory Database · Published May 14, 2024

BouncyCastle.Cryptography is fixed in 2.3.1 (NuGet)

Bouncy Castle crafted signature and public key can be used to trigger an infinite loop

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
org.bouncycastle:bctls-jdk18on	Maven Central	1.78
org.bouncycastle:bcprov-jdk14	Maven Central	1.78
org.bouncycastle:bcprov-jdk18on	Maven Central	1.78
org.bouncycastle:bcprov-jdk15to18	Maven Central	1.78
BouncyCastle.Cryptography	NuGet	2.3.1
org.bouncycastle:bctls-jdk14	Maven Central	1.78
org.bouncycastle:bctls-jdk15to18	Maven Central	1.78
gradle-8	Chainguard	8.7.0-r4
keycloak-operator	Chainguard	24.0.4-r2
ruby3.2-bouncy-castle-java	Wolfi	1.5.0146.1-r4
keycloak	Chainguard	25.0.0-r0
ruby3.3-bouncy-castle-java	Wolfi	1.5.0146.1-r1

21 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

5.300000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Vendor	Product	Versions
chainguard	gradle-8	0
chainguard	keycloak-operator	0
wolfi	ruby3.2-bouncy-castle-java	0
chainguard	keycloak	0
wolfi	ruby3.3-bouncy-castle-java	0
wolfi	gradle-8	0
Maven	org.bouncycastle:bctls-jdk18on	1.73
chainguard	opensearch-2	0
Maven	org.bouncycastle:bcprov-jdk18on	1.73
Maven	org.bouncycastle:bcprov-jdk15to18	1.73
NuGet	BouncyCastle.Cryptography	0
chainguard	keycloak-fips	0
chainguard	hive	0
chainguard	ruby3.3-bouncy-castle-java	0
chainguard	gradle-stage0	0
Maven	org.bouncycastle:bcprov-jdk14	1.73
Maven	org.bouncycastle:bctls-jdk14	1.73
chainguard	sonarqube-10	0
chainguard	elasticsearch-fips-8	0
wolfi	opensearch-2	0

…and 14 more

Timeline

May 14, 2024 CVE Published
Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-m44j-cfrm-g8qc
vulnetix vdb fixes GHSA-m44j-cfrm-g8qc

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-m44j-cfrm-g8qc/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →