Multiple vulnerabilities in the Bouncy Castle cryptography library (CVSS Base Score 7.5) allow an unauthenticated remote attacker to cause a denial-of-service condition or perform DNS poisoning attacks. The core library is affected in versions prior to 1.78.1. A wide range of enterprise products from vendors including Atlassian, IBM, NetApp, Red Hat, and SUSE are also impacted, as detailed in the advisory's extensive patch timeline.
[WID-SEC-2024-1031] Bouncy Castle: Mehrere Schwachstellen CVSS Base Score 7.5 (hoch) CVSS Temporal Score 6.5 (mittel) Remoteangriff ja Datum 05.05.2024 Stand UPDATE 19.03.2026 Mitigation ja Betroffene Systeme Betriebssystem Linux Produktbeschreibung Bouncy Castle ist eine Kryptographie-API fĂĽr Java. Produkte UPDATE 18.03.2026 Ubuntu Linux UPDATE 05.10.2025 SAS Institute Base SAS <9.4M9 (TS1M9) UPDATE 01.07.2025 NetApp ActiveIQ Unified Manager for Linux NetApp ActiveIQ Unified Manager for VMware vSphere NetApp ActiveIQ Unified Manager for Microsoft Windows UPDATE 30.03.2025 IBM SPSS Collaboration and Deployment Services 8.5 UPDATE 18.03.2025 Atlassian Bitbucket <9.5.2 Atlassian Bitbucket <9.4.4 Atlassian Bitbucket <8.19.16 Atlassian Bitbucket <8.9.26 UPDATE 17.12.2024 Hitachi Ops Center UPDATE 05.12.2024 NetApp ActiveIQ Unified Manager UPDATE 19.11.2024 Atlassian Bitbucket UPDATE 17.09.2024 Atlassian Confluence <8.9.4 Atlassian Confluence <8.5.12 Atlassian Confluence <9.0.1 Atlassian Confluence <7.19.26 IBM Storage Scale 5.1.0.0-5.1.9.4 UPDATE 11.09.2024 IBM Tivoli Key Lifecycle Manager UPDATE 03.09.2024 IBM Security Guardium UPDATE 25.08.2024 IBM Storage Scale <5.2.1.0 IBM Storage Scale <5.1.9.5 UPDATE 13.08.2024 IBM DB2 UPDATE 11.07.2024 IBM QRadar SIEM <7.5.0 UP9 UPDATE 07.07.2024 IBM MQ UPDATE 02.07.2024 Red Hat Enterprise Linux UPDATE 26.06.2024 IBM License Metric Tool 9.2 UPDATE 12.06.2024 RealObjects PDFreactor <11.6.12 UPDATE 12.05.2024 SUSE Linux 05.05.2024 Open Source Bouncy Castle <1.78.1 Angriff Angriff Ein anonymer Angreifer kann mehrere Schwachstellen in Bouncy Castle ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder einen DNS-Poisoning-Angriff durchzufĂĽhren. CVE Informationen Versionshistorie Feedback zum Advisory geben