Skip to content
Fencer Vulns
medium 5.3

CVE-2023-33201 json

Bouncy Castle For Java LDAP injection vulnerability

published 2023-07-05 3 y ago modified 2026-09-10 1 mo ago also GHSA-hr8g-6v94-x4m9 , EUVD-2023-2081

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Patch / fix

  • maven org.bouncycastle:bcprov-jdk18on 1.74
  • maven org.bouncycastle:bcprov-jdk15to18 1.74
  • maven org.bouncycastle:bcprov-jdk14 1.74
  • maven org.bouncycastle:bcprov-ext-jdk14 1.74
  • maven org.bouncycastle:bcprov-ext-jdk15to18 1.74
  • maven org.bouncycastle:bcprov-ext-jdk18on 1.74
  • maven org.bouncycastle:bcprov-debug-jdk14 1.74
  • maven org.bouncycastle:bcprov-debug-jdk15to18 1.74
  • maven org.bouncycastle:bcprov-debug-jdk18on 1.74
  • bouncycastle bc-java 1.74
  • bouncycastle Debian 14, Debian 13 1.77-1

debian advisories DEBIAN-CVE-2023-33201

  • bouncycastle Ubuntu Pro 16.04 LTS 1.51-4ubuntu1+esm1
  • bouncycastle Ubuntu Pro 18.04 LTS 1.59-1ubuntu0.1~esm1
  • bouncycastle Ubuntu Pro 20.04 LTS 1.61-1ubuntu0.1~esm1
  • bouncycastle Ubuntu Pro 22.04 LTS 1.68-5ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2023-33201

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-netty jboss enterprise application platform 7.4 4.1.94-1.Final_redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.13-8.GA_redhat_00001.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.4 3.15.8-1.Final_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.26-1.SP1_redhat_00001.1.el8eap
  • eap7-hibernate jboss enterprise application platform 7.4 5.3.31-1.Final_redhat_00001.1.el8eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.94-1.Final_redhat_00001.1.el8eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.19-1.Final_redhat_00001.1.el8eap
  • eap7-ironjacamar jboss enterprise application platform 7.4 1.5.15-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2023:5485RHSA-2023:5486RHSA-2023:5484RHSA-2023:7484RHSA-2023:7483RHSA-2023:7482

  • bouncycastle SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +11 more 1.74-150200.3.21.1

suse advisories SUSE-SU-2023:2843-1

  • bouncycastle openSUSE Tumbleweed 1.74-1.1

opensuse advisories openSUSE-SU-2024:13016-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-33201 updated cvss 5.3

bouncycastle: potential blind LDAP injection attack using a self-signed certificate

  • Red Hat Migration Toolkit for Applications 6 bouncycastle Red Hat Migration Toolkit for Runtimes bouncycastle Red Hat build of Apicurio Registry 2 bouncycastle bouncycastle Red Hat build of Debezium 1 bouncycastle bouncycastle Red Hat build of Debezium 2 bouncycastle bouncycastle Red Hat build of Quarkus bcprov-jdk15on
    +1 more products
    Red Hat Data Grid 8 bouncycastle bouncycastle
    affected: no fix planned “Will not fix”
  • Red Hat Decision Manager 7 bouncycastle bouncycastle
    affected: no fix available
  • Red Hat Integration Camel K 1 bouncycastle bouncycastle Red Hat Integration Camel Quarkus 2 bouncycastle bouncycastle Red Hat JBoss Data Grid 7 bouncycastle bouncycastle
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 6 bouncycastle bouncycastle
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack bouncycastle bouncycastle
    affected: no fix available
  • Red Hat JBoss Fuse 6 bouncycastle bouncycastle Red Hat JBoss Fuse Service Works 6 bouncycastle bouncycastle Red Hat OpenShift Application Runtimes bouncycastle bouncycastle
    affected: no fix planned “Out of support scope”
  • Red Hat AMQ Broker 7.11.5
    fixed: vendor fix RHSA-2024:0278
  • Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8 2.4.0-2, cryostat-tech-preview/jfr-datasource-rhel8 2.4.0-2, cryostat-tech-preview/cryostat-reports-rhel8 2.4.0-2, cryostat-tech-preview/cryostat-rhel8-operator 2.4.0-3, cryostat-tech-preview/cryostat-operator-bundle 2.4.0-2, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8 2.4.0-2
    fixed: vendor fix RHSA-2023:7669
show 16 more
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-36
    fixed: vendor fix RHSA-2023:7486
  • Red Hat AMQ Streams 2.5.0
    fixed: vendor fix RHSA-2023:5165
  • Red Hat AMQ Streams 2.6.0
    fixed: vendor fix RHSA-2023:7678
  • Red Hat AMQ Streams 2.7.0
    fixed: vendor fix RHSA-2024:3527
  • Red Hat Fuse 7.12
    fixed: vendor fix RHSA-2023:3954
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-bouncycastle 1.76.0-4.redhat_00001.1.el7eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el7eap, eap7-bouncycastle-mail 1.76.0-4.redhat_00001.1.el7eap, eap7-bouncycastle-pkix 1.76.0-4.redhat_00001.1.el7eap, eap7-bouncycastle-prov 1.76.0-4.redhat_00001.1.el7eap, eap7-bouncycastle-util 1.76.0-4.redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2023:5484
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-bouncycastle 1.76.0-4.redhat_00001.1.el8eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el8eap, eap7-bouncycastle-mail 1.76.0-4.redhat_00001.1.el8eap, eap7-bouncycastle-pkix 1.76.0-4.redhat_00001.1.el8eap, eap7-bouncycastle-prov 1.76.0-4.redhat_00001.1.el8eap, eap7-bouncycastle-util 1.76.0-4.redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2023:5485
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-bouncycastle 1.76.0-4.redhat_00001.1.el9eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el9eap, eap7-bouncycastle-mail 1.76.0-4.redhat_00001.1.el9eap, eap7-bouncycastle-pkix 1.76.0-4.redhat_00001.1.el9eap, eap7-bouncycastle-prov 1.76.0-4.redhat_00001.1.el9eap, eap7-bouncycastle-util 1.76.0-4.redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2023:5486
  • Red Hat JBoss Enterprise Application Platform bcprov-jdk18on 1.76.0.redhat-00001
    fixed: vendor fix RHSA-2023:5488
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:7488
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.11-2.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.11-2.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:7482
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.11-2.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.11-2.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:7483
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.11-2.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.11-2.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:7484
  • Red Hat RHINT Camel-Springboot 3.18.3.2
    fixed: vendor fix RHSA-2023:5147
  • Red Hat RHPAM 7.13.5 async
    fixed: vendor fix RHSA-2024:1353
  • Red Hat A-MQ Clients 2 bouncycastle bouncycastle Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat A-MQ Online bouncycastle bouncycastle Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el7eap, eap7-netty 4.1.94-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el7eap, eap7-hibernate 5.3.31-1.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.94-1.Final_redhat_00001.1.el7eap, +89 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el8eap, eap7-netty 4.1.94-1.Final_redhat_00001.1.el8eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el8eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el8eap, eap7-hibernate 5.3.31-1.Final_redhat_00001.1.el8eap, eap7-netty-all 4.1.94-1.Final_redhat_00001.1.el8eap, +90 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el9eap, eap7-netty 4.1.94-1.Final_redhat_00001.1.el9eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el9eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el9eap, eap7-hibernate 5.3.31-1.Final_redhat_00001.1.el9eap, eap7-mod_cluster 1.4.5-1.Final_redhat_00001.1.el9eap, +87 more
    +1 more products
    Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1550 more
    not affected: vulnerable code not present

1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
23 mo ago

Exploit prediction

0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.bouncycastle:bcprov-jdk18on
<1.74
1.74
maven org.bouncycastle:bcprov-jdk15to18
<1.74
1.74
maven org.bouncycastle:bcprov-jdk14
>=1.49, <1.74
1.74
maven org.bouncycastle:bcprov-ext-jdk14
>=1.49, <1.74
1.74
maven org.bouncycastle:bcprov-ext-jdk15to18
<1.74
1.74
maven org.bouncycastle:bcprov-ext-jdk18on
<1.74
1.74
maven org.bouncycastle:bcprov-debug-jdk14
>=1.49, <1.74
1.74
maven org.bouncycastle:bcprov-debug-jdk15to18
<1.74
1.74
maven org.bouncycastle:bcprov-debug-jdk18on
<1.74
1.74
maven org.bouncycastle:bcprov-jdk15on
>=1.49, <=1.70
 no fix listed
maven org.bouncycastle:bcprov-ext-jdk15on
>=1.49, <=1.70
 no fix listed
maven org.bouncycastle:bcprov-debug-jdk15on
>=1.49, <=1.70
 no fix listed

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.