Bouncy Castle Java Cryptography API vulnerable to DNS poisoning
GHSA-4h8f-2wvx-gg5w · CVE-2024-34447
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-34447
- WEB https://github.com/bcgit/bc-java/issues/1656
- PACKAGE https://github.com/bcgit/bc-java
- WEB https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447
- WEB https://www.bouncycastle.org/latest_releases.html
- WEB http://security.netapp.com/advisory/ntap-20240614-0007
Ready to move
Start Securing
Free, no credit card | First findings in minutes