Oracle Financial Services Applications / Security (Bouncy Castle Java Library) CVEs

VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago

Description contains RASP scope Status Exploitation Severity

Reset

Overview 2 matches, all in RASP scope · 0 protected · 0 KEV · 1 public PoC · 0 CISA SSVC · 0 EPSS ≥ 0.5 · 0 disputed

2matches, all in RASP scope 0protected0.0% 0KEV0.0% 1public PoC50.0% 0CISA SSVC0.0% 0EPSS ≥ 0.50.0% 0disputed0.0%

Critical 0 0.0% High 1 50.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

Protected by RASP 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 100.0% No exploit published 0 0.0% No fix identified 0 0.0% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%

blocked by ARMR today 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited in the wild 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 100.0%

split by SeverityStatusProtectionExploit maturity peak 1 / quarter

Q4 20Q1 21Q2 21Q3 21Q4 21Q1 22Q2 22Q3 22Q4 22Q1 23Q2 23Q3 23

2 matches CSV JSON

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2023-33201	Medium	2023-07-05	Mitigation candidate	No public exploit	Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.
CVE-2020-28052	High	2020-12-18	Mitigation candidate	No public exploit	An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2023-33201

Medium

2023-07-05

Mitigation candidate

No public exploit

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

CVE-2020-28052

High

2020-12-18

Mitigation candidate

No public exploit

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.