CVE-2024-30172
Aliases:CGA-qh5m-p3cq-84w2CGA-jjwj-6v39-vh3fGHSA-m44j-cfrm-g8qcDEBIAN-CVE-2024-30172CGA-3fjr-cf7h-rmfcCGA-4c8q-pc5q-wfrcCGA-522q-gwmg-7655CGA-8jwc-w73j-v39mCGA-9gph-cxhr-85x3CGA-cfr2-qjmv-8c8vCGA-fvhc-ccrc-832hCGA-g9qp-6r2w-cw8gCGA-gq8j-mg23-xhj5CGA-h8w3-h2vf-5p25CGA-hh3c-754x-g9qgCGA-jm42-mg84-42fqCGA-p5gw-hf7c-fm5jCGA-272p-8qcg-5jj3CGA-285g-29x5-r9w9CGA-2cqp-934r-8fp4CGA-2f73-xf6j-xjmgCGA-2jcx-c925-h3f5CGA-2q9c-qwqw-vf6rCGA-2rjj-8c2j-c3wfCGA-32c7-p9g8-395wCGA-38w9-8435-j8gvCGA-3fgg-w6cq-vcx9CGA-3pfg-p673-6c6gCGA-3rgc-hwfc-g4vrCGA-423q-47hc-wxjgCGA-4938-57gm-7p66CGA-4m9j-r89f-gw4cCGA-4mq6-c4p3-5gf9CGA-4q78-pp89-296wCGA-4wph-427p-2ph9CGA-5cxj-8c5j-6wv3CGA-639w-xfxq-rhpwCGA-6554-7jvf-6mw7CGA-67cc-6h2q-2rxpCGA-6f2f-j5wp-cv83CGA-6gpp-9hh8-wxq2CGA-72mw-7hmc-mv3mCGA-78wg-9rjp-q67qCGA-7cvf-32gm-xg8qCGA-7cx4-wx42-vjm7CGA-7f85-m4fg-7p7vCGA-7q83-4m7w-77chCGA-8fp2-wjf4-fr7fCGA-8h6j-85h3-xhj4CGA-8p4j-222j-cjwgCGA-94f5-xw4p-j35jCGA-96xh-h3fv-8353CGA-9782-m2qw-27xmCGA-98cq-fm98-8853CGA-9g2x-4q8w-7q2gCGA-9mrv-3j9h-hj38CGA-9p53-jjm3-5j62CGA-c62v-m72w-xc48CGA-c932-qrmr-jjcwCGA-c99w-84jw-xhr6CGA-cmf8-pm3f-59c5CGA-cx2c-h7pq-2mfvCGA-cxg3-pr64-2x8vCGA-f59m-8v99-4x76CGA-gq7v-cgp7-9r73CGA-grh9-xmjr-mh4cCGA-gwf4-xfc4-93gjCGA-h3c4-r686-fp7hCGA-h3v4-h37m-p8f7CGA-h9pf-rrhx-gxhwCGA-hhwv-g6pr-x65jCGA-hmxp-hhpf-j39xCGA-j4c4-3ccg-f24hCGA-jcc7-57v8-vq79CGA-jm9q-jg89-4wf5CGA-jrhh-rq35-8h4mCGA-jxqw-xrff-wc9pCGA-m3f2-6v53-ggm7CGA-m5xw-9hhx-33w2CGA-mjv7-5vjr-88j7CGA-mq6v-9jp2-q97wCGA-p56r-3fph-636vCGA-pgqc-5f4q-c79gCGA-phxw-vf7q-mwx6CGA-pwph-4pj7-7c6wCGA-q3h5-3pfp-3gx2CGA-q3q3-rw6w-pc2qCGA-q5jm-7546-m83jCGA-q8q4-68hf-f5fxCGA-qhrr-vcmw-hp96CGA-qjx5-9wr2-rrh8CGA-qvj7-v8c8-79g3CGA-qwpm-jrqq-cjrgCGA-r8vm-j74x-74r8CGA-rm65-356c-qhq5CGA-rp9w-548g-jxp7CGA-rq46-9qrf-rc47CGA-v33q-wr5w-jr8hCGA-v562-g7rp-hqg8CGA-vh37-9c44-r94hCGA-wc93-3hqr-vwfpCGA-wqjg-88r6-8h37CGA-wqx4-pgv7-gc3wCGA-wv8m-rrcr-6p4hCGA-x3f5-xgg9-pfg2CGA-x5j6-5w92-q5fpCGA-xqx5-4fcp-w98gCGA-xwfj-54h2-2jrfCGA-gf2m-mqq4-p827CGA-mqh6-rgj9-39p9
Advisory lineage Upstream: 0 Downstream: 9
Deferred
Published: 09 May 2024, 00:00
Last modified:05 Nov 2024, 17:15
Vulnerability Summary
Overall Risk (default)
medium
30/100 CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.75% LOW
1% probability +0.62%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
09 May 2024, 00:00
Published
Vulnerability first disclosed
05 Nov 2024, 17:15
Last Modified
Vulnerability information updated
Description
An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.
CVSS Metrics
- v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Trends
Current EPSS score: 0.75%• Percentile: 54%
Affected Systems
- chainguard•eco-java-gradle-8.8
all
- chainguard•elasticsearch-7
< 7.17.22-r0
- chainguard•elasticsearch-7-iamguarded
< 7.17.22-r0
- chainguard•gradle-8
< 8.7.0-r4
- chainguard•gradle-stage0
< 8.0.1-r0
- chainguard•jruby-9.4
< 9.4.8.0-r0
- chainguard•jruby-9.4-default-ruby
< 9.4.8.0-r0
- chainguard•keycloak
< 25.0.0-r0
- chainguard•logstash-jre-bcfips
< 8.13.4-r0
- chainguard•opensearch-2
< 2.16.0-r0
- chainguard•opensearch-2-alerting
< 2.16.0-r0
- chainguard•opensearch-2-analysis-icu
< 2.16.0-r0
- chainguard•opensearch-2-analysis-kuromoji
< 2.16.0-r0
- chainguard•opensearch-2-analysis-nori
< 2.16.0-r0
- chainguard•opensearch-2-analysis-phonetic
< 2.16.0-r0
- chainguard•opensearch-2-analysis-smartcn
< 2.16.0-r0
- chainguard•opensearch-2-analysis-stempel
< 2.16.0-r0
- chainguard•opensearch-2-analysis-ukrainian
< 2.16.0-r0
- chainguard•opensearch-2-anomaly-detection
< 2.16.0-r0
- chainguard•opensearch-2-asynchronous-search
< 2.16.0-r0
- chainguard•opensearch-2-cross-cluster-replication
< 2.16.0-r0
- chainguard•opensearch-2-crypto-kms
< 2.16.0-r0
- chainguard•opensearch-2-custom-codecs
< 2.16.0-r0
- chainguard•opensearch-2-discovery-azure-classic
< 2.16.0-r0
- chainguard•opensearch-2-discovery-ec2
< 2.16.0-r0
- chainguard•opensearch-2-discovery-gce
< 2.16.0-r0
- chainguard•opensearch-2-entrypoint-compat
< 2.16.0-r0
- chainguard•opensearch-2-geospatial
< 2.16.0-r0
- chainguard•opensearch-2-identity-shiro
< 2.16.0-r0
- chainguard•opensearch-2-index-management
< 2.16.0-r0
- chainguard•opensearch-2-ingest-attachment
< 2.16.0-r0
- chainguard•opensearch-2-job-scheduler
< 2.16.0-r0
- chainguard•opensearch-2-k-nn
< 2.16.0-r0
- chainguard•opensearch-2-mapper-annotated-text
< 2.16.0-r0
- chainguard•opensearch-2-mapper-murmur3
< 2.16.0-r0
- chainguard•opensearch-2-mapper-size
< 2.16.0-r0
- chainguard•opensearch-2-ml-commons
< 2.16.0-r0
- chainguard•opensearch-2-neural-search
< 2.16.0-r0
- chainguard•opensearch-2-notifications
< 2.16.0-r0
- chainguard•opensearch-2-observability
< 2.16.0-r0
- chainguard•opensearch-2-performance-analyzer
< 2.16.0-r0
- chainguard•opensearch-2-reporting
< 2.16.0-r0
- chainguard•opensearch-2-repository-azure
< 2.16.0-r0
- chainguard•opensearch-2-repository-gcs
< 2.16.0-r0
- chainguard•opensearch-2-repository-s3
< 2.16.0-r0
- chainguard•opensearch-2-security
< 2.16.0-r0
- chainguard•opensearch-2-security-analytics
< 2.16.0-r0
- chainguard•opensearch-2-sql
< 2.16.0-r0
- chainguard•opensearch-2-store-smb
< 2.16.0-r0
- chainguard•opensearch-2-telemetry-otel
< 2.16.0-r0
Showing first 50 affected entries in server-rendered view.
References (10)
- https://www.bouncycastle.org/latest_releases.html
- https://security.netapp.com/advisory/ntap-20240614-0007/
- https://nvd.nist.gov/vuln/detail/CVE-2024-30172
- https://github.com/bcgit/bc-java/commit/1b9fd9b545e691bfb3941a9f6a797660c8860f02
- https://github.com/bcgit/bc-java/commit/9c165791b68a204678b48ec11e4e579754c2ea49
- https://github.com/bcgit/bc-java/commit/ebe1c75579170072dc59b8dee2b55ce31663178f
- https://github.com/bcgit/bc-csharp/wiki/CVE%E2%80%902024%E2%80%9030172
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9030172
- https://security.netapp.com/advisory/ntap-20240614-0007
- https://security-tracker.debian.org/tracker/CVE-2024-30172