CVE-2023-33201

Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability.

• CWE-295

• https://bouncycastle.orgProduct
• https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bccPatch
• https://github.com/bcgit/bc-java/wiki/CVE-2023-33201Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html
• https://security.netapp.com/advisory/ntap-20230824-0008/
• https://bouncycastle.orgProduct
• https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bccPatch
• https://github.com/bcgit/bc-java/wiki/CVE-2023-33201Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00000.html
• https://security.netapp.com/advisory/ntap-20230824-0008/

Published

Jul 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-33196Craft is a CMS for creating custom digital experiences. Cros…5.4
• CVE-2023-33197Craft is a CMS for creating custom digital experiences on th…5.4
• CVE-2023-33198tgstation-server is a production scale tool for BYOND server…7.5
• CVE-2023-33199Rekor's goals are to provide an immutable tamper resistant l…5.3
• CVE-2023-3320The WP Sticky Social plugin for WordPress is vulnerable to …8.8
• CVE-2023-33200A local non-privileged user can make improper GPU processing…4.7
• CVE-2023-33202Bouncy Castle for Java before 1.73 contains a potential Deni…5.5
• CVE-2023-33203The Linux kernel before 6.2.9 has a race condition and resul…6.4
• CVE-2023-33204sysstat through 12.7.2 allows a multiplication integer overf…7.8
• CVE-2023-33206Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8
• CVE-2023-33207Cross-Site Request Forgery (CSRF) vulnerability in Krzysztof…8.8
• CVE-2023-33208Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8