bouncycastle-1.74-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:13016 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z bouncycastle-1.74-1.1 on GA media These are all security issues fixed in the bouncycastle-1.74-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-13016 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:13016 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2023-33201/ SUSE CVE CVE-2023-33201 page openSUSE Tumbleweed bouncycastle-1.74-1.1 bouncycastle-javadoc-1.74-1.1 bouncycastle-jmail-1.74-1.1 bouncycastle-mail-1.74-1.1 bouncycastle-pg-1.74-1.1 bouncycastle-pkix-1.74-1.1 bouncycastle-tls-1.74-1.1 bouncycastle-util-1.74-1.1 bouncycastle-1.74-1.1 as a component of openSUSE Tumbleweed bouncycastle-javadoc-1.74-1.1 as a component of openSUSE Tumbleweed bouncycastle-jmail-1.74-1.1 as a component of openSUSE Tumbleweed bouncycastle-mail-1.74-1.1 as a component of openSUSE Tumbleweed bouncycastle-pg-1.74-1.1 as a component of openSUSE Tumbleweed bouncycastle-pkix-1.74-1.1 as a component of openSUSE Tumbleweed bouncycastle-tls-1.74-1.1 as a component of openSUSE Tumbleweed bouncycastle-util-1.74-1.1 as a component of openSUSE Tumbleweed Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability. CVE-2023-33201 openSUSE Tumbleweed:bouncycastle-1.74-1.1 openSUSE Tumbleweed:bouncycastle-javadoc-1.74-1.1 openSUSE Tumbleweed:bouncycastle-jmail-1.74-1.1 openSUSE Tumbleweed:bouncycastle-mail-1.74-1.1 openSUSE Tumbleweed:bouncycastle-pg-1.74-1.1 openSUSE Tumbleweed:bouncycastle-pkix-1.74-1.1 openSUSE Tumbleweed:bouncycastle-tls-1.74-1.1 openSUSE Tumbleweed:bouncycastle-util-1.74-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-33201.html CVE-2023-33201 https://bugzilla.suse.com/1212508 SUSE Bug 1212508