[GHSA-574f-3g2m-x479] Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks - #8524
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the GHSA-574f-3g2m-x479 advisory metadata to reflect revised affected packages and scoring/severity information for the Bouncy Castle GOST 28147 CTR keystream-reuse issue.
Changes:
- Updates the CVSS v4 vector and downgrades
database_specific.severityfromCRITICALtoHIGH. - Re-adds
bcprov-jdk15onto theaffectedpackages list. - Bumps the advisory
modifiedtimestamp.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| { | ||
| "package": { | ||
| "ecosystem": "Maven", | ||
| "name": "bcprov-jdk15on" |
There was a problem hiding this comment.
Whoever has push rights, yes, this commit suggestion should be applied.
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "1.59" | ||
| } | ||
| ] | ||
| } | ||
| ] |
There was a problem hiding this comment.
Maven Central does not yet list a published 1.84 version for this package. See repo1.maven.org/maven2/org/bouncycastle/bcprov-jdk15on. Therefore, we can't be sure whether a future 1.84 version would fix the vulnerability.
|
👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the |
ef35f70
into
simon-reisinger-dynatrace/advisory-improvement-8524
|
Hi @simon-reisinger-dynatrace! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
Re-adding
bcprov-jdk15onas proposed here. This is the legacy, unmaintained predecessor tobcprov-jdk15to18andbcprov-jdk18onthat was split into those two artifacts. As of now, Maven Central has no published 1.84 version for this package (see repo1.maven.org/maven2/org/bouncycastle/bcprov-jdk15on), so no fix version can be set.Also had to patch the CVSS vector as it was malformed.