CyberRota Analysis
AI-GeneratedBouncy Castle for Java versions prior to 1.85, as well as specific LTS and FIPS versions, are vulnerable due to the CMS verifySignatures function incorrectly returning true for SignedData objects that contain zero signers. This flaw could lead to false validation of signatures, potentially allowing unauthorized access or manipulation of data. Organizations utilizing affected versions of Bouncy Castle in their Java applications should prioritize remediation to mitigate the risk of security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
Related CVEs
Other vulnerabilities affecting the same vendor(s)