7.5

CVE-2024-34447: druid

CVSS: 7.5v3.1HighDeferred
AliasesUBUNTU-CVE-2024-34447DEBIAN-CVE-2024-34447CGA-3cg5-99qf-2g79
Published 03-05-2024Last modified 17-06-2025
Open JSON

Vulnerability summary

CVE-2024-34447 is a high (CVSS 7.5) vulnerability in druid. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.8% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.77%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 15
CGA-2WGV-29FQ-XG2JCGA-3M6G-6XJP-M4P6CGA-3X9X-7JR9-JQXPCGA-7XQH-M7HM-WMH3CGA-C2CG-6QFV-HCJ9CGA-F55C-XQ37-F8V2

Timeline

  1. 03-05-2024
    PublishedVulnerability first disclosed.
  2. 17-06-2025
    Last modifiedVulnerability information updated.

Description

An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.77%

Chance of exploitation in the next 30 days

Percentile

55%

Versus all other CVEs

30-day change

0.00 pp

From 0.77% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.77%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard125 products
  • druid< 37.0.0-r8
  • eco-java-gradle-5.4All versions (No fix recorded)
  • eco-java-gradle-5.4.1All versions (No fix recorded)
  • eco-java-gradle-5.5All versions (No fix recorded)
  • eco-java-gradle-5.5.1All versions (No fix recorded)
Wolfi10 products
  • druid< 37.0.0-r8
  • gradle-8< 8.7.0-r4
  • gradle-stage0All versions (No fix recorded)
  • jruby-9.4< 9.4.8.0-r0
  • jruby-9.4-default-ruby< 9.4.8.0-r0
Org.bouncycastle7 products
  • bcprov-jdk12≥ 1.61, < 1.78
  • bcprov-jdk14≥ 1.61, < 1.78
  • bcprov-jdk15on≥ 1.61, < 1.78
  • bcprov-jdk15to18≥ 1.61, < 1.78
  • bcprov-jdk18on≥ 1.61, < 1.78
Debian1 product
  • bouncycastleAll versions (No fix recorded) | < 1.80-1
Ubuntu1 product
  • bouncycastle< 1.61-1ubuntu0.1~esm1 | < 1.68-5ubuntu0.1~esm1 | < 1.77-1ubuntu0.1~esm1

5 vendors · 144 products

References

11 links
Show all 11 references