Описание
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
A flaw was found in Bouncy Castle Java Cryptography APIs. Affected versions of this package are vulnerable to a use of incorrectly-resolved name or reference issue when resolving domain names over an SSL socket that was created without an explicit hostname, such as in the HttpsURLConnection() function. If endpoint identification is enabled, this flow allows an attacker to trigger hostname verification against a DNS-resolved address.
Отчет
The vulnerability in Bouncy Castle Java Cryptography APIs, allowing for incorrect resolution of domain names during SSL/TLS connections without explicitly specifying a hostname, is assessed as moderate severity due to its potential impact on security. By exploiting this flaw, an attacker could manipulate DNS resolution to present a different server's certificate, leading to a mismatch between expected and verified hostnames. While this could facilitate a man-in-the-middle attack under specific conditions, its severity is moderated by the prerequisite of the attacker controlling DNS responses or intercepting network traffic.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | org.bouncycastle-bctls | Will not fix | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/elasticsearch6-rhel8 | Not affected | ||
| Migration Toolkit for Applications 6 | org.bouncycastle-bctls | Will not fix | ||
| Migration Toolkit for Runtimes | org.bouncycastle-bctls | Will not fix | ||
| Red Hat build of Apache Camel for Spring Boot 3 | org.bouncycastle-bctls | Out of support scope | ||
| Red Hat Build of Keycloak | org.bouncycastle-bctls | Affected | ||
| Red Hat Data Grid 8 | org.bouncycastle-bctls | Not affected | ||
| Red Hat Fuse 7 | org.bouncycastle-bctls | Not affected | ||
| Red Hat Integration Camel K 1 | org.bouncycastle-bctls | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 7 | org.bouncycastle-bctls | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
An issue was discovered in the Bouncy Castle Crypto Package For Java b ...
Bouncy Castle Java Cryptography API vulnerable to DNS poisoning
EPSS
5.3 Medium
CVSS3