*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Partial details (18 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
The jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK).
It is written in Java and relies solely on the JCA APIs for cryptography.
Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-29857
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
Direct dependency fix Resolution (com.box:box-java-sdk): 4.7.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000342
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000340
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-15522
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
Direct dependency fix Resolution (com.box:box-java-sdk): 4.7.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-51775
### Vulnerable Library - jose4j-0.4.4.jar
The jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK).
It is written in Java and relies solely on the JCA APIs for cryptography.
Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..
Direct dependency fix Resolution (com.box:box-java-sdk): 4.7.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2023-0116
### Vulnerable Library - jose4j-0.4.4.jar
The jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK).
It is written in Java and relies solely on the JCA APIs for cryptography.
Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..
RSA1_5 in jose4j is susceptible to chosen ciphertext attacks. The
attack allows to decrypt RSA1_5 or RSA_OAEP encrypted ciphertexts. It may be feasible to sign with affected keys.
Direct dependency fix Resolution (com.box:box-java-sdk): 4.6.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000352
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000344
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000343
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000338
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-30172
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.
The jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK).
It is written in Java and relies solely on the JCA APIs for cryptography.
Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..
Direct dependency fix Resolution (com.box:box-java-sdk): 4.6.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000341
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-26939
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
Direct dependency fix Resolution (com.box:box-java-sdk): 4.7.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000339
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-33201
### Vulnerable Library - bcprov-jdk15on-1.52.jar
The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
WS-2017-0208
### Vulnerable Library - jose4j-0.4.4.jarThe jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK). It is written in Java and relies solely on the JCA APIs for cryptography. Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..
Library home page: https://bitbucket.org/b_c/jose4j/
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bitbucket/b_c/jose4j/0.4.4/jose4j-0.4.4.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **jose4j-0.4.4.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability Analysis This vulnerability is potentially reachable ``` org.jose4j.jwe.EcdhKeyAgreementAlgorithm (Application) -> org.jose4j.jwa.AlgorithmFactoryFactory (Extension) -> org.jose4j.jws.JsonWebSignature (Extension) -> com.box.sdk.BoxDeveloperEditionAPIConnection (Extension) -> ❌ com.box.l10n.mojito.boxsdk.BoxSDKJWTProvider (Vulnerable Component) ``` ### Vulnerability DetailsAffected versions of the package are vulnerable to Elliptic Curve Key Disclosure.
Publish Date: 2017-04-14
URL: WS-2017-0208
### Threat AssessmentExploit Maturity: Not Defined
EPSS:
### CVSS 4 Score Details (9.0)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bitbucket.org/b_c/jose4j/commits/0517896170af8d5c057407c70a7b08dae454829e
Release Date: 2017-01-31
Fix Resolution (org.bitbucket.b_c:jose4j): 0.5.5
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-29857
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability Analysis This vulnerability is potentially reachable ``` org.bouncycastle.math.ec.ECCurve (Application) -> org.bouncycastle.asn1.x9.X9ECParameters (Extension) -> org.bouncycastle.openssl.PEMParser$ECCurveParamsParser (Extension) -> org.bouncycastle.openssl.PEMParser (Extension) -> com.box.sdk.BoxDeveloperEditionAPIConnection (Extension) -> ❌ com.box.l10n.mojito.boxsdk.BoxSDKJWTProvider (Vulnerable Component) ``` ### Vulnerability DetailsAn issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.
Publish Date: 2024-05-14
URL: CVE-2024-29857
### Threat AssessmentExploit Maturity: Not Defined
EPSS:
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-8xfc-gm6g-vgpv
Release Date: 2024-05-14
Fix Resolution: org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk18on:1.78, BouncyCastle.Cryptography - 2.3.1
CVE-2019-17359
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability Analysis This vulnerability is potentially reachable ``` org.bouncycastle.asn1.ASN1InputStream (Application) -> org.bouncycastle.asn1.ASN1Primitive (Extension) -> org.bouncycastle.openssl.PEMParser$ECCurveParamsParser (Extension) -> org.bouncycastle.openssl.PEMParser (Extension) -> com.box.sdk.BoxDeveloperEditionAPIConnection (Extension) -> ❌ com.box.l10n.mojito.boxsdk.BoxSDKJWTProvider (Vulnerable Component) ``` ### Vulnerability DetailsThe ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
Publish Date: 2019-10-08
URL: CVE-2019-17359
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.6%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17359
Release Date: 2019-10-08
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.64
Direct dependency fix Resolution (com.box:box-java-sdk): 4.7.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000342
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability Analysis This vulnerability is potentially reachable ``` org.bouncycastle.asn1.ASN1Enumerated (Application) -> org.bouncycastle.asn1.ASN1InputStream (Extension) -> org.bouncycastle.openssl.PEMParser$PKCS7Parser (Extension) -> org.bouncycastle.openssl.PEMParser (Extension) -> com.box.sdk.BoxDeveloperEditionAPIConnection (Extension) -> ❌ com.box.l10n.mojito.boxsdk.BoxSDKJWTProvider (Vulnerable Component) ``` ### Vulnerability DetailsIn the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Publish Date: 2018-06-04
URL: CVE-2016-1000342
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.4%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000342
Release Date: 2018-06-04
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.56
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000340
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability Analysis This vulnerability is potentially reachable ``` org.bouncycastle.math.raw.Nat224 (Application) -> org.bouncycastle.math.ec.custom.sec.SecP224K1Point (Extension) -> org.bouncycastle.math.ec.custom.sec.SecP224K1Curve (Extension) -> org.apache.directory.server.core.DefaultDirectoryService (Extension) ... -> org.springframework.security.config.annotation.authentication.configurers.ldap.LdapAuthenticationProviderConfigurer$ContextSourceBuilder (Extension) -> org.springframework.security.config.annotation.authentication.configurers.ldap.LdapAuthenticationProviderConfigurer (Extension) -> ❌ com.box.l10n.mojito.security.UserDetailsContextMapperImpl (Vulnerable Component) ``` ### Vulnerability DetailsIn the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
Publish Date: 2018-06-04
URL: CVE-2016-1000340
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.2%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000340
Release Date: 2018-06-04
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.56
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-15522
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability Analysis This vulnerability is potentially reachable ``` org.bouncycastle.math.ec.ECPoint (Application) -> org.bouncycastle.asn1.x9.X9ECParameters (Extension) -> org.bouncycastle.openssl.PEMParser$ECCurveParamsParser (Extension) -> org.bouncycastle.openssl.PEMParser (Extension) -> com.box.sdk.BoxDeveloperEditionAPIConnection (Extension) -> ❌ com.box.l10n.mojito.boxsdk.BoxSDKJWTProvider (Vulnerable Component) ``` ### Vulnerability DetailsBouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
Publish Date: 2021-05-20
URL: CVE-2020-15522
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.1%
### CVSS 4 Score Details (8.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15522
Release Date: 2021-05-20
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.66
Direct dependency fix Resolution (com.box:box-java-sdk): 4.7.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-51775
### Vulnerable Library - jose4j-0.4.4.jarThe jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK). It is written in Java and relies solely on the JCA APIs for cryptography. Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..
Library home page: https://bitbucket.org/b_c/jose4j/
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bitbucket/b_c/jose4j/0.4.4/jose4j-0.4.4.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **jose4j-0.4.4.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability Analysis This vulnerability is potentially reachable ``` org.jose4j.jwe.JsonWebEncryption (Application) -> org.jose4j.jwx.JsonWebStructure (Extension) -> org.jose4j.jws.JsonWebSignature (Extension) -> com.box.sdk.BoxDeveloperEditionAPIConnection (Extension) -> ❌ com.box.l10n.mojito.boxsdk.BoxSDKJWTProvider (Vulnerable Component) ``` ### Vulnerability DetailsThe jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
Publish Date: 2023-12-25
URL: CVE-2023-51775
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.0%
### CVSS 4 Score Details (7.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-51775
Release Date: 2023-12-25
Fix Resolution (org.bitbucket.b_c:jose4j): 0.9.4
Direct dependency fix Resolution (com.box:box-java-sdk): 4.7.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2023-0116
### Vulnerable Library - jose4j-0.4.4.jarThe jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK). It is written in Java and relies solely on the JCA APIs for cryptography. Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..
Library home page: https://bitbucket.org/b_c/jose4j/
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bitbucket/b_c/jose4j/0.4.4/jose4j-0.4.4.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **jose4j-0.4.4.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability Analysis This vulnerability is potentially reachable ``` org.jose4j.jwe.JsonWebEncryption (Application) -> org.jose4j.jwx.JsonWebStructure (Extension) -> org.jose4j.jws.JsonWebSignature (Extension) -> com.box.sdk.BoxDeveloperEditionAPIConnection (Extension) -> ❌ com.box.l10n.mojito.boxsdk.BoxSDKJWTProvider (Vulnerable Component) ``` ### Vulnerability DetailsRSA1_5 in jose4j is susceptible to chosen ciphertext attacks. The attack allows to decrypt RSA1_5 or RSA_OAEP encrypted ciphertexts. It may be feasible to sign with affected keys.
Publish Date: 2023-04-27
URL: WS-2023-0116
### Threat AssessmentExploit Maturity: Not Defined
EPSS:
### CVSS 4 Score Details (6.9)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-jgvc-jfgh-rjvv
Release Date: 2023-04-27
Fix Resolution (org.bitbucket.b_c:jose4j): 0.9.3
Direct dependency fix Resolution (com.box:box-java-sdk): 4.6.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000352
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability AnalysisThe vulnerable code is unreachable
### Vulnerability DetailsIn the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Publish Date: 2018-06-04
URL: CVE-2016-1000352
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.2%
### CVSS 4 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000352
Release Date: 2018-06-04
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.56
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000344
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability AnalysisThe vulnerable code is unreachable
### Vulnerability DetailsIn the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Publish Date: 2018-06-04
URL: CVE-2016-1000344
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.2%
### CVSS 4 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000344
Release Date: 2018-06-04
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.56
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000343
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability AnalysisThe vulnerable code is unreachable
### Vulnerability DetailsIn the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
Publish Date: 2018-06-04
URL: CVE-2016-1000343
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.4%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000343
Release Date: 2018-06-04
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.56
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000338
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability AnalysisThe vulnerable code is unreachable
### Vulnerability DetailsIn Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Publish Date: 2018-06-01
URL: CVE-2016-1000338
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.6%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000338
Release Date: 2018-06-01
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.56
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-30172
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability AnalysisThe vulnerable code is unreachable
### Vulnerability DetailsAn issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.
Publish Date: 2024-05-09
URL: CVE-2024-30172
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.0%
### CVSS 4 Score Details (8.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://security-tracker.debian.org/tracker/CVE-2024-30172
Release Date: 2024-03-24
Fix Resolution: org.bouncycastle:bcprov-jdk18on:1.78,org.bouncycastle:bcprov-jdk15to18:1.78, org.bouncycastle:bcprov-jdk14:1.78
CVE-2023-31582
### Vulnerable Library - jose4j-0.4.4.jarThe jose.4.j library is a robust and easy to use open source implementation of JSON Web Token (JWT) and the JOSE specification suite (JWS, JWE, and JWK). It is written in Java and relies solely on the JCA APIs for cryptography. Please see https://bitbucket.org/b_c/jose4j/wiki/Home for more info, examples, etc..
Library home page: https://bitbucket.org/b_c/jose4j/
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bitbucket/b_c/jose4j/0.4.4/jose4j-0.4.4.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **jose4j-0.4.4.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability AnalysisThe vulnerable code is unreachable
### Vulnerability Detailsjose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.
Publish Date: 2023-10-24
URL: CVE-2023-31582
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.0%
### CVSS 4 Score Details (8.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bitbucket.org/b_c/jose4j/issues/203/insecure-support-of-setting-pbe-less-then
Release Date: 2023-10-24
Fix Resolution (org.bitbucket.b_c:jose4j): 0.9.3
Direct dependency fix Resolution (com.box:box-java-sdk): 4.6.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000341
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability AnalysisThe vulnerable code is unreachable
### Vulnerability DetailsIn the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
Publish Date: 2018-06-04
URL: CVE-2016-1000341
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.4%
### CVSS 4 Score Details (8.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000341
Release Date: 2018-06-04
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.56
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-26939
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability AnalysisThe vulnerable code is unreachable
### Vulnerability DetailsIn Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
Publish Date: 2020-11-02
URL: CVE-2020-26939
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.1%
### CVSS 4 Score Details (6.9)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-11-02
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.61
Direct dependency fix Resolution (com.box:box-java-sdk): 4.7.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2016-1000339
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability AnalysisThe vulnerable code is unreachable
### Vulnerability DetailsIn the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.
Publish Date: 2018-06-04
URL: CVE-2016-1000339
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.3%
### CVSS 4 Score Details (6.9)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000339
Release Date: 2018-06-04
Fix Resolution (org.bouncycastle:bcprov-jdk15on): 1.56
Direct dependency fix Resolution (com.box:box-java-sdk): 2.25.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-33201
### Vulnerable Library - bcprov-jdk15on-1.52.jarThe Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8.
Library home page: http://www.bouncycastle.org/java.html
Path to dependency file: /webapp/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.52/bcprov-jdk15on-1.52.jar
Dependency Hierarchy: - box-java-sdk-2.1.1.jar (Root Library) - :x: **bcprov-jdk15on-1.52.jar** (Vulnerable Library)
Found in HEAD commit: 012e83ee9b10e35eced839f51b8019c57f33234b
Found in base branch: main
### Reachability AnalysisThe vulnerable code is unreachable
### Vulnerability DetailsBouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.
Publish Date: 2023-07-05
URL: CVE-2023-33201
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.1%
### CVSS 4 Score Details (6.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2023-07-05
Fix Resolution: org.bouncycastle:bcprov-ext-jdk18on:1.74, org.bouncycastle:bcprov-jdk18on:1.74, org.bouncycastle:bcprov-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-debug-jdk18on:1.74, org.bouncycastle:bcprov-ext-jdk15to18:1.74, org.bouncycastle:bcprov-jdk15to18:1.74, org.bouncycastle:bcprov-debug-jdk14:1.74, org.bouncycastle:bcprov-debug-jdk15to18:1.74, org.bouncycastle:bcprov-ext-debug-jdk14:1.74, org.bouncycastle:bcprov-ext-debug-jdk15to18:1.74, org.bouncycastle:bcprov-jdk14:1.74
:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.