CVE catalog

CVE-2023-33201

Bouncy Castle vulnerabilities

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.77% · Oct 27, 2026

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbouncycastlesid1.86.2-1fixed
Debianbouncycastleforky1.86-1fixed
Debianbouncycastletrixie1.80-3fixed
Debianbouncycastlebookworm1.72-2vulnerable
UbuntubouncycastlenobleNot reportedvulnerable
Ubuntubouncycastlenoble1.77-1ubuntu0.1~esm1fixed
Ubuntulibbcjmail-javanoble1.77-1ubuntu0.1~esm1fixed
Ubuntulibbcmail-javanoble1.77-1ubuntu0.1~esm1fixed
Ubuntulibbcpg-javanoble1.77-1ubuntu0.1~esm1fixed
Ubuntulibbcpkix-javanoble1.77-1ubuntu0.1~esm1fixed
Ubuntulibbcprov-javanoble1.77-1ubuntu0.1~esm1fixed
Ubuntulibbctls-javanoble1.77-1ubuntu0.1~esm1fixed
Ubuntulibbcutil-javanoble1.77-1ubuntu0.1~esm1fixed
Ubuntubouncycastlepro1.72-2vulnerable
Ubuntubouncycastlepro1.77-1vulnerable
Ubuntubouncycastlepro1.77-1ubuntu0.1~esm1fixed
Ubuntubouncycastlepro1.68-2vulnerable
Ubuntubouncycastlepro1.68-4vulnerable
Ubuntubouncycastlepro1.68-5vulnerable
Ubuntubouncycastlepro1.68-5ubuntu0.1~esm1fixed
Opensusebouncycastletumbleweed1.74-1.1fixed
Susebouncycastlelinux enterprise module for development tools 15 sp41.74-150200.3.21.1fixed
Susebouncycastlelinux enterprise module for development tools 15 sp51.74-150200.3.21.1fixed
Susebouncycastlelinux enterprise high performance computing 15 sp2-ltss1.74-150200.3.21.1fixed
Susebouncycastlelinux enterprise high performance computing 15 sp3-espos1.74-150200.3.21.1fixed
Susebouncycastlelinux enterprise high performance computing 15 sp3-ltss1.74-150200.3.21.1fixed
Susebouncycastlelinux enterprise real time 15 sp31.74-150200.3.21.1fixed
Susebouncycastlelinux enterprise server 15 sp2-ltss1.74-150200.3.21.1fixed
Susebouncycastlelinux enterprise server 15 sp3-ltss1.74-150200.3.21.1fixed
Susebouncycastlelinux enterprise server for sap applications 15 sp21.74-150200.3.21.1fixed
Susebouncycastlelinux enterprise server for sap applications 15 sp31.74-150200.3.21.1fixed
Susebouncycastleenterprise storage 71.74-150200.3.21.1fixed
Susebouncycastleenterprise storage 7.11.74-150200.3.21.1fixed
Opensusebouncycastleleap 15.41.74-150200.3.21.1fixed
Opensusebouncycastleleap 15.51.74-150200.3.21.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbouncycastlesourcesid1.77-1not yet assignedNot reported[1040050]
Debianbouncycastlesourceforky1.77-1not yet assignedNot reported[1040050]
Debianbouncycastlesourcetrixie1.77-1not yet assignedNot reported[1040050]
Debianbouncycastlesourcebookworm(unfixed)not yet assignedNot reported[1040050]
Ubuntubouncycastledebnoble1.77-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibbcjmail-javadebnoble1.77-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibbcmail-javadebnoble1.77-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibbcpg-javadebnoble1.77-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibbcpkix-javadebnoble1.77-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibbcprov-javadebnoble1.77-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibbctls-javadebnoble1.77-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntulibbcutil-javadebnoble1.77-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntubouncycastledebpro1.77-1ubuntu0.1~esm1Not reportedUSN-8108-1Not reported
Ubuntubouncycastledebpro1.68-5ubuntu0.1~esm1Not reportedUBUNTU-CVE-2023-33201Not reported
Opensusebouncycastlerpmtumbleweed1.74-1.1Not reportedOPENSUSE-SU-2024:13016-1Not reported
Susebouncycastlerpmlinux enterprise module for development tools 15 sp41.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmlinux enterprise module for development tools 15 sp51.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmlinux enterprise high performance computing 15 sp2-ltss1.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmlinux enterprise high performance computing 15 sp3-espos1.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmlinux enterprise high performance computing 15 sp3-ltss1.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmlinux enterprise real time 15 sp31.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmlinux enterprise server 15 sp2-ltss1.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmlinux enterprise server 15 sp3-ltss1.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmlinux enterprise server for sap applications 15 sp21.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmlinux enterprise server for sap applications 15 sp31.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmenterprise storage 71.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Susebouncycastlerpmenterprise storage 7.11.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Opensusebouncycastlerpmleap 15.41.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported
Opensusebouncycastlerpmleap 15.51.74-150200.3.21.1Not reportedSUSE-SU-2023:2843-1Not reported

[Debian bug #1040050]

Notes

[bookworm] bouncycastle: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libbcjmail-java]Affected

    Source package: [bouncycastle]

    Details (2)

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

  • [libbcmail-java]Affected

    Source package: [bouncycastle]

    Details (2)

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

  • [libbcpg-java]Affected

    Source package: [bouncycastle]

    Details (2)

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

  • [libbcpkix-java]Affected

    Source package: [bouncycastle]

    Details (2)

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

  • [libbcprov-java]Affected

    Source package: [bouncycastle]

    Details (2)

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

  • [libbctls-java]Affected

    Source package: [bouncycastle]

    Details (2)

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

  • [libbcutil-java]Affected

    Source package: [bouncycastle]

    Details (2)

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

    • 1.72-2 · all · bookworm

      Affected

      usn · bouncycastle · debian · bookworm; usn · bouncycastle · debian · 12

[openSUSE Tumbleweed]

  • [bouncycastle-javadoc]Unknown

    Source package: [bouncycastle]

    Details (1)

    • 1.85-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.74-1.1

      Version impact unknown

      usn · bouncycastle · opensuse · tumbleweed

  • [bouncycastle-jmail]Unknown

    Source package: [bouncycastle]

    Details (1)

    • 1.85-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.74-1.1

      Version impact unknown

      usn · bouncycastle · opensuse · tumbleweed

  • [bouncycastle-mail]Unknown

    Source package: [bouncycastle]

    Details (1)

    • 1.85-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.74-1.1

      Version impact unknown

      usn · bouncycastle · opensuse · tumbleweed

  • [bouncycastle-pg]Unknown

    Source package: [bouncycastle]

    Details (1)

    • 1.85-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.74-1.1

      Version impact unknown

      usn · bouncycastle · opensuse · tumbleweed

  • [bouncycastle-pkix]Unknown

    Source package: [bouncycastle]

    Details (1)

    • 1.85-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.74-1.1

      Version impact unknown

      usn · bouncycastle · opensuse · tumbleweed

  • [bouncycastle-tls]Unknown

    Source package: [bouncycastle]

    Details (1)

    • 1.85-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.74-1.1

      Version impact unknown

      usn · bouncycastle · opensuse · tumbleweed

  • [bouncycastle-util]Unknown

    Source package: [bouncycastle]

    Details (1)

    • 1.85-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.74-1.1

      Version impact unknown

      usn · bouncycastle · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [libbcjmail-java]Fixed

    Source package: [bouncycastle]

    Details (2)

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

  • [libbcmail-java]Fixed

    Source package: [bouncycastle]

    Details (2)

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

  • [libbcpg-java]Fixed

    Source package: [bouncycastle]

    Details (2)

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

  • [libbcpkix-java]Fixed

    Source package: [bouncycastle]

    Details (2)

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

  • [libbcprov-java]Fixed

    Source package: [bouncycastle]

    Details (2)

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

  • [libbctls-java]Fixed

    Source package: [bouncycastle]

    Details (2)

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

    • 1.80-3 · all · trixie

      Fixed · Fixed: 1.77-1

      usn · bouncycastle · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]