CVE-2024-34447: High severity IBM Planning Analytics vulnerability
An issue was discovered in Bouncy Castle Java Cryptography APIs before BC 1.78. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
https://www.bouncycastle.org/latestreleases.html
Other sources
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
— MITRE
The Bouncy Castle Crypto Package For Java could allow a remote attacker to bypass security restrictions, caused by a flaw when endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname. By sending a specially crafted request, an attacker could exploit this vulnerability to perform DNS poisoning attack.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.bouncycastle:bcprov-lts8onto a version that resolves this vulnerability.Fixed in 2.73.6 - Upgrade
Upgrade
maven/org.bouncycastle:bctls-fipsto a version that resolves this vulnerability.Fixed in 1.0.19 - Upgrade
Upgrade
maven/org.bouncycastle:bcprov-jdk12to a version that resolves this vulnerability.Fixed in 1.78 - Upgrade
Upgrade
maven/org.bouncycastle:bcprov-jdk14to a version that resolves this vulnerability.Fixed in 1.78 - Upgrade
Upgrade
maven/org.bouncycastle:bcprov-jdk15to18to a version that resolves this vulnerability.Fixed in 1.78 - Upgrade
Upgrade
maven/org.bouncycastle:bcprov-jdk18onto a version that resolves this vulnerability.Fixed in 1.78 - Upgrade
Upgrade
redhat/BCto a version that resolves this vulnerability.Fixed in 1.78 - Upgrade
Upgrade
Bouncy Castle Java Cryptography APIsto a version that resolves this vulnerability.Fixed in 1.78 - Upgrade
Upgrade
Bouncy Castle Crypto Package For Java (BC TLS Java)to a version that resolves this vulnerability.Fixed in 1.0.19 - Upgrade
Upgrade
Bouncy Castle FIPS TLS Javato a version that resolves this vulnerability.Fixed in 1.0.19 - Configuration
Ensure endpoint identification is not enabled when creating an SSL socket without an explicit hostname; the issue occurs when BCJSSE has endpoint identification enabled and an SSL socket is created without an explicit hostname (e.g., via HttpsURLConnection), which can lead to hostname verification against a DNS-resolved IP and enable DNS poisoning.
BCJSSE endpoint identification = enabled - Compensating control
Mitigate DNS poisoning impact by restricting/monitoring DNS resolution paths (e.g., ensure DNS integrity via trusted resolvers and monitoring) since hostname verification can be performed against a DNS-resolved IP address in some situations.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34447?
CVE-2024-34447 has a high severity due to potential vulnerabilities in SSL socket communication when hostname verification is inadequate.
How do I fix CVE-2024-34447?
To fix CVE-2024-34447, upgrade to Bouncy Castle version 1.78 or later.
Which versions of Bouncy Castle are affected by CVE-2024-34447?
CVE-2024-34447 affects Bouncy Castle Java Cryptography APIs versions prior to 1.78.
What impact does CVE-2024-34447 have on applications?
CVE-2024-34447 may allow an attacker to perform man-in-the-middle attacks if hostname verification fails.
Is CVE-2024-34447 specific to certain software vendors?
CVE-2024-34447 affects various packages under Bouncy Castle, including those used in IBM Planning Analytics.