CVE-2024-34447

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-34447
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447
https://security.netapp.com/advisory/ntap-20240614-0007/
https://www.bouncycastle.org/latest_releases.html
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447
https://security.netapp.com/advisory/ntap-20240614-0007/
https://www.bouncycastle.org/latest_releases.html
Configurations

No configuration.

History

17 Jun 2025, 20:15

Type Values Removed Values Added
Summary (en) An issue was discovered in Bouncy Castle Java Cryptography APIs before BC 1.78. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning. (en) An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

20 Mar 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-297

21 Nov 2024, 09:18

Type Values Removed Values Added
References () https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447 - () https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447 -
References () https://security.netapp.com/advisory/ntap-20240614-0007/ - () https://security.netapp.com/advisory/ntap-20240614-0007/ -
References () https://www.bouncycastle.org/latest_releases.html - () https://www.bouncycastle.org/latest_releases.html -

14 Jun 2024, 13:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240614-0007/ -

14 May 2024, 15:39

Type Values Removed Values Added
References
  • () https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447 -
Summary
  • (es) Se descubrió un problema en las API de criptografía Java de Bouncy Castle antes de BC 1.78. Cuando la identificación de endpoint está habilitada en BCJSSE y se crea un socket SSL sin un nombre de host explícito (como sucede con HttpsURLConnection), la verificación del nombre de host podría realizarse contra una dirección IP resuelta por DNS en algunas situaciones, lo que abre una posibilidad de envenenamiento de DNS.

03 May 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-03 16:15

Updated : 2025-06-17 20:15

NVD link : CVE-2024-34447

Mitre link : CVE-2024-34447

CVE.ORG link : CVE-2024-34447

JSON object : View

Products Affected

No product.

CWE
CWE-297

Improper Validation of Certificate with Host Mismatch