CVE-2024-29857
Last modified
CVE-2024-29857 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.. EPSS estimates a 1.10% chance of exploitation in the next 30 days.
Description
An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-29857?
How severe is CVE-2024-29857?
How do I fix CVE-2024-29857?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-2985A vulnerability was found in Tenda FH1202 1.2.0.14(408). It …8.8
- CVE-2024-29850Veeam Backup Enterprise Manager allows account takeover via …8.8
- CVE-2024-29851Veeam Backup Enterprise Manager allows high-privileged users…7.2
- CVE-2024-29852Veeam Backup Enterprise Manager allows high-privileged users…2.7
- CVE-2024-29853An authentication bypass vulnerability in Veeam Agent for Mi…7.8
- CVE-2024-29855Hard-coded JWT secret allows authentication bypass in Veeam …9
- CVE-2024-29858In MISP before 2.4.187, __uploadLogo in app/Controller/Organ…9.8
- CVE-2024-29859In MISP before 2.4.187, add_misp_export in app/Controller/Ev…9.8
- CVE-2024-2986A vulnerability was found in Tenda FH1202 1.2.0.14(408). It …8.8
- CVE-2024-29862The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder…7.5
- CVE-2024-29863A race condition in the installer executable in Qlik Qlikvie…7.8
- CVE-2024-29864Distrobox before 1.7.0.1 allows attackers to execute arbitra…9.8
Are you affected by CVE-2024-29857?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST