Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-34447

Good to know:

icon
icon

Date: May 2, 2024

An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

Language: Java

Severity Score

Related Resources (8)

https://github.com/bcgit/bc-java
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447
https://security.netapp.com/advisory/ntap-20240614-0007/
https://www.bouncycastle.org/latest_releases.html
https://nvd.nist.gov/vuln/detail/CVE-2024-34447
https://github.com/bcgit/bc-java/issues/1656
https://security.netapp.com/advisory/ntap-20240614-0007
https://www.mend.io/vulnerability-database/CVE-2024-34447

Severity Score

Weakness Type (CWE)

Improper Validation of Certificate with Host Mismatch

CWE-297

Top Fix

icon

Upgrade Version

Upgrade to version org.bouncycastle:bctls-fips:1.0.19;org.bouncycastle:bcprov-jdk18on:1.78;org.bouncycastle:bcprov-jdk15to18:1.78;org.bouncycastle:bcprov-jdk14:1.78;org.bouncycastle:bcprov-lts8on:2.73.6

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us