Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability.
Priority LOW 25CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 17 fixed, 16 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.
Summary
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00772 55th percentileScored 2026-11-07
Fix Partial org.bouncycastle:bcprov-jdk18on (Maven): 1.74org.bouncycastle:bcprov-jdk15to18 (Maven): 1.74+7 more productsRed Hat: 17 advisoriesRed Hat: 17 fixed, 16 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.bouncycastle:bcprov-jdk18on (Maven) | before 1.74 | 1.74 | Patch available | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-jdk15to18 (Maven) | before 1.74 | 1.74 | Patch available | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-jdk14 (Maven) | 1.49 to before 1.74 | 1.74 | Patch available | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-ext-jdk14 (Maven) | 1.49 to before 1.74 | 1.74 | Patch available | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-ext-jdk15to18 (Maven) | before 1.74 | 1.74 | Patch available | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-ext-jdk18on (Maven) | before 1.74 | 1.74 | Patch available | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-debug-jdk14 (Maven) | 1.49 to before 1.74 | 1.74 | Patch available | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-debug-jdk15to18 (Maven) | before 1.74 | 1.74 | Patch available | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-debug-jdk18on (Maven) | before 1.74 | 1.74 | Patch available | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-jdk15on (Maven) | 1.49 – 1.70 | — | No fix listed | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-ext-jdk15on (Maven) | 1.49 – 1.70 | — | No fix listed | GHSA-hr8g-6v94-x4m9 |
| — | org.bouncycastle:bcprov-debug-jdk15on (Maven) | 1.49 – 1.70 | — | No fix listed | GHSA-hr8g-6v94-x4m9 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.bouncycastle:bcprov-jdk18on (Maven) Vendor— Affected before 1.74 Fixed in 1.74 Patch available GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-jdk15to18 (Maven) Vendor— Affected before 1.74 Fixed in 1.74 Patch available GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-jdk14 (Maven) Vendor— Affected 1.49 to before 1.74 Fixed in 1.74 Patch available GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-ext-jdk14 (Maven) Vendor— Affected 1.49 to before 1.74 Fixed in 1.74 Patch available GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-ext-jdk15to18 (Maven) Vendor— Affected before 1.74 Fixed in 1.74 Patch available GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-ext-jdk18on (Maven) Vendor— Affected before 1.74 Fixed in 1.74 Patch available GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-debug-jdk14 (Maven) Vendor— Affected 1.49 to before 1.74 Fixed in 1.74 Patch available GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-debug-jdk15to18 (Maven) Vendor— Affected before 1.74 Fixed in 1.74 Patch available GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-debug-jdk18on (Maven) Vendor— Affected before 1.74 Fixed in 1.74 Patch available GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-jdk15on (Maven) Vendor— Affected 1.49 – 1.70 Fixed in — No fix listed GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-ext-jdk15on (Maven) Vendor— Affected 1.49 – 1.70 Fixed in — No fix listed GHSA-hr8g-6v94-x4m9
- org.bouncycastle:bcprov-debug-jdk15on (Maven) Vendor— Affected 1.49 – 1.70 Fixed in — No fix listed GHSA-hr8g-6v94-x4m9
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:* | before 1.74 | Vulnerable | Legion of the Bouncy Castle Inc. |
- cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:* Versions before 1.74 Vulnerable ·Legion of the Bouncy Castle Inc.
Remediation
- Fix · GHSA-hr8g-6v94-x4m9 org.bouncycastle:bcprov-jdk18on (Maven) Fixed in 1.74 Advisory →
- Fix · GHSA-hr8g-6v94-x4m9 org.bouncycastle:bcprov-jdk15to18 (Maven) Fixed in 1.74 Advisory →
- Fix · GHSA-hr8g-6v94-x4m9 org.bouncycastle:bcprov-jdk14 (Maven) Fixed in 1.74 Advisory →
- Fix · GHSA-hr8g-6v94-x4m9 org.bouncycastle:bcprov-ext-jdk14 (Maven) Fixed in 1.74 Advisory →
- Fix · GHSA-hr8g-6v94-x4m9 org.bouncycastle:bcprov-ext-jdk15to18 (Maven) Fixed in 1.74 Advisory →
- Fix · GHSA-hr8g-6v94-x4m9 org.bouncycastle:bcprov-ext-jdk18on (Maven) Fixed in 1.74 Advisory →
- Fix · GHSA-hr8g-6v94-x4m9 org.bouncycastle:bcprov-debug-jdk14 (Maven) Fixed in 1.74 Advisory →
- Fix · GHSA-hr8g-6v94-x4m9 org.bouncycastle:bcprov-debug-jdk15to18 (Maven) Fixed in 1.74 Advisory →
- Fix · GHSA-hr8g-6v94-x4m9 org.bouncycastle:bcprov-debug-jdk18on (Maven) Fixed in 1.74 Advisory →
Red Hat 17 advisories
- RHSA-2024:3527 Released 2024-05-30 · Red Hat rating ModerateRed Hat AMQ Streams 2.7.0 release and security update
- Red Hat AMQ Streams 2.7.0
- RHSA-2024:1353 Released 2024-03-18 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.5 security update
- RHPAM 7.13.5 async
- RHSA-2024:0278 Released 2024-01-17 · Red Hat rating ModerateRed Hat AMQ Broker 7.11.5 release and security update
- AMQ Broker 7.11.5
Show 14 more Red Hat advisories
- RHSA-2023:7678 Released 2023-12-06 · Red Hat rating ImportantRed Hat AMQ Streams 2.6.0 release and security update
- Red Hat AMQ Streams 2.6.0
- RHSA-2023:7669 Released 2023-12-06 · Red Hat rating ModerateRed Hat build of Cryostat 2.4.0: new RHEL 8 container images
- Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
- RHSA-2023:7488 Released 2023-11-24 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.6 security update
- Red Hat Single Sign-On 7
- RHSA-2023:7484 Released 2023-11-24 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.6 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.11-2.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.11-2.redhat_00001.1.el9sso
- RHSA-2023:7483 Released 2023-11-24 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.6 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.11-2.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.11-2.redhat_00001.1.el8sso
- RHSA-2023:7482 Released 2023-11-24 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.6 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.11-2.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.11-2.redhat_00001.1.el7sso
- RHSA-2023:7486 Released 2023-11-24 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.6 for OpenShift image enhancement and security update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2023:5485 Released 2023-10-06 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el8eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el8eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el8eap +47
- RHSA-2023:5486 Released 2023-10-06 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el9eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el9eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el9eap +47
- RHSA-2023:5484 Released 2023-10-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el7eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el7eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el7eap +47
- RHSA-2023:5488 Released 2023-10-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.13 security update
- Red Hat JBoss Enterprise Application Platform io.netty.netty-handler-4.1.94.Final-redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.76.0.redhat-00001.jar, org.jboss.hal.hal-console-3.3.19.Final-redhat-00001-resources.jar +2
- RHSA-2023:5165 Released 2023-09-14 · Red Hat rating ImportantRed Hat AMQ Streams 2.5.0 release and security update
- Red Hat AMQ Streams 2.5.0
- RHSA-2023:5147 Released 2023-09-13 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.18.3.2 release and security update
- RHINT Camel-Springboot 3.18.3.2
- RHSA-2023:3954 Released 2023-06-29 · Red Hat rating CriticalRed Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Runtimes | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix yet |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel Quarkus 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix planned: Out of support scope |
| Red Hat build of Apicurio Registry 2 | Affected | No fix planned: Will not fix |
| Red Hat build of Debezium 1 | Affected | No fix planned: Will not fix |
| Red Hat build of Debezium 2 | Affected | No fix planned: Will not fix |
| Red Hat build of Quarkus | Affected | No fix planned: Will not fix |
| AMQ Broker 7.11.5 | Fixed | RHSA-2024:0278 |
| Cryostat 2 on RHEL 8 | Fixed | RHSA-2023:7669 |
| Middleware Containers for OpenShift | Fixed | RHSA-2023:7486 |
| RHINT Camel-Springboot 3.18.3.2 | Fixed | RHSA-2023:5147 |
| RHPAM 7.13.5 async | Fixed | RHSA-2024:1353 |
| Red Hat AMQ Streams 2.5.0 | Fixed | RHSA-2023:5165 |
| Red Hat AMQ Streams 2.6.0 | Fixed | RHSA-2023:7678 |
| Red Hat AMQ Streams 2.7.0 | Fixed | RHSA-2024:3527 |
| Red Hat Fuse 7.12 | Fixed | RHSA-2023:3954 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:5484 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:5485 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:5486 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2023:5488 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2023:7488 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2023:7482 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2023:7483 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2023:7484 |
Not affected: 8 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- Red Hat A-MQ Online
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-33201
- 2026-10-03 Alias added: GHSA-hr8g-6v94-x4m9
References
Advisory 2
Other 8
- https://bouncycastle.org
- [debian-lts-announce] 20230802 [SECURITY] [DLA 3514-1] bouncycastle security update
- https://security.netapp.com/advisory/ntap-20230824-0008/
- https://github.com/bcgit/bc-java/commit/ccf93ca736b89250ff4ce079a5aa56f5cbf0ebbd
- https://bouncycastle.org/releasenotes.html#r1rv74
- https://github.com/bcgit/bc-java
- https://github.com/bcgit/bc-java/commits/main/prov/src/main/java/org/bouncycastle/jce/provider/X509LDAPCertStoreSpi.java
- https://security.netapp.com/advisory/ntap-20230824-0008
More Legion of the Bouncy Castle Inc. Bc-java vulnerabilities
- TI-2018-15967 Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to… CVSS 3.1CRITICAL 9.8
- TI-2017-09736 BouncyCastle JCE TLS Bleichenbacher/ROBOT CVSS 3.0HIGH 7.5
- TI-2026-42545 MTI/A0 DH agreement exponentiates unvalidated peer value CVSS 4.0CRITICAL 9.3
- TI-2026-42533 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in CVSS 4.0CRITICAL 9.3
- TI-2026-41816 Stapled OCSP response accepted without binding to the checked certificate CVSS 4.0CRITICAL 9.3
- TI-2026-07701 Name Constraints bypass via trailing dot in rfc822Name and URI CVSS 4.0CRITICAL 9.3
Sources
- CVE-2023-33201 · CVE Program
- CVE-2023-33201 · NVD
- FIRST EPSS
- GHSA-hr8g-6v94-x4m9 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-33201 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences