CVE-2023-33201

Katalog CVE

CVSS 5.3 · Medium EPSS 0,77%

Kerentanan Improper Certificate Validation pada bouncycastle bc-java. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Rincian

Terbit di NVD

5 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bcgit/bc-java/wiki/CVE-2023-33201 advisory vendor
• https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc patch
• https://bouncycastle.org product
• https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html
• https://security.netapp.com/advisory/ntap-20230824-0008/