CyberRota Analysis
AI-GeneratedBouncy Castle for Java versions prior to 1.85, as well as specific LTS and FIPS releases, are vulnerable due to a flaw in CCM-family modes that allows plaintext to be written to the caller's buffer before the integrity tag is verified. This could lead to potential information leakage, compromising the confidentiality of sensitive data. Organizations utilizing affected versions of Bouncy Castle for cryptographic operations should prioritize updating to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).