|
Vulnerabilities
< Back

CVE-2023-33201

Updated on 05 Jul 2023

Severity

5.3 Medium severity

Details

CVSS score
5.3
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate’s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Details

Affected product:
Apache Hive , Bouncy Castle , Eclipse Jetty , OkHttp , Spring , Wildfly , cocoon , directory-server , druid , gradle , itextpdf , java-cas-client , java-datastore , java-opensaml , jets3t , jgit , logging-log4j2 , netty , opensaml-security-api , solr , wildfly , ws-wss4j
Affected packages:
gradle-api-metadata @ 6.9.4 (+1837 more)
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate’s Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Fixes