CVE-2019-17359

The ASN.1 parser in Bouncy Castle Crypto (BC Java) version 1.63 contains a vulnerability that allows specially crafted ASN.1 data to trigger an attempted large memory allocation, resulting in an OutOfMemoryError. This is a denial-of-service (DoS) condition that can crash the Java application or make it unresponsive [1].

An attacker can exploit this by supplying malicious ASN.1 encoded input to an application that uses the vulnerable Bouncy Castle library. No authentication is required if the application parses untrusted ASN.1 data, and the attack can be delivered over the network if the application accepts remote input. The crafted data forces the parser to attempt to allocate an excessive amount of memory, exhausting the available heap space [1].

Successful exploitation leads to a denial of service, disrupting services that rely on Bouncy Castle for cryptographic operations. The vulnerability is fixed in Bouncy Castle Crypto version 1.64. Users should upgrade to version 1.64 or later to mitigate the risk. No workaround is documented [1].