High severity7.5NVD Advisory· Published May 3, 2024· Updated Apr 15, 2026

CVE-2024-34447

Description

An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.bouncycastle:bcprov-jdk18onMaven	>= 1.61, < 1.78	1.78
org.bouncycastle:bcprov-jdk15to18Maven	>= 1.61, < 1.78	1.78
org.bouncycastle:bcprov-jdk14Maven	>= 1.61, < 1.78	1.78
org.bouncycastle:bcprov-jdk12Maven	>= 1.61, < 1.78	1.78
org.bouncycastle:bctls-fipsMaven	< 1.0.19	1.0.19
org.bouncycastle:bcprov-lts8onMaven	< 2.73.6	2.73.6
org.bouncycastle:bcprov-jdk15onMaven	>= 1.61, < 1.78	1.78

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-4h8f-2wvx-gg5wghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-34447ghsaADVISORY
security.netapp.com/advisory/ntap-20240614-0007ghsaWEB
github.com/bcgit/bc-java/issues/1656ghsaWEB
www.bouncycastle.org/latest_releases.htmlnvdWEB
security.netapp.com/advisory/ntap-20240614-0007/nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000