CyberRota Analysis
AI-GeneratedBouncy Castle for Java versions prior to 1.85, as well as specific LTS and FIPS versions, are vulnerable due to an S/MIME validator that improperly trusts signer-asserted signingTime during path validation. This flaw could potentially allow attackers to manipulate signing times, leading to unauthorized access or validation of malicious signatures. Organizations utilizing affected versions of Bouncy Castle for Java, particularly those handling sensitive data or relying on secure email communications, should prioritize updating to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
Related CVEs
Other vulnerabilities affecting the same vendor(s)