Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-33202
CVE-2023-33202:
Java vulnerability analysis and mitigation
Overview
CVE-2023-33202 affects Bouncy Castle for Java versions prior to 1.73, specifically impacting the org.bouncycastle.openssl.PEMParser class. This vulnerability was discovered in the parser that handles OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects (NVD). For users of the FIPS Java API, versions BC-FJA 1.0.2.3 and earlier are affected, while BC-FJA 1.0.2.4 contains the fix (Bouncy Castle).
Technical details
The vulnerability exists in the PEMParser class's handling of ASN.1 data. When parsing a file containing crafted ASN.1 data through the PEMParser, it can trigger an OutOfMemoryError. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local access is required and user interaction is needed (NVD).
Impact
The successful exploitation of this vulnerability can lead to a Denial of Service (DoS) condition. When triggered, the vulnerability causes an OutOfMemoryError, which can make the affected service unavailable (NetApp Advisory).
Mitigation and workarounds
The primary mitigation is to upgrade to Bouncy Castle for Java version 1.73 or later. For users of the FIPS Java API, upgrading to BC-FJA 1.0.2.4 or later will resolve the vulnerability. Various vendors have also released patches for their affected products, such as NetApp releasing updates for E-Series SANtricity OS Controller Software 11.x and other affected products (NetApp Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management