PT-2026-104129 · Bc-Csharp · Bc-Csharp
CVSS v4.0
7.1
عالية
| المتجه | AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
bc-csharp versions prior to 2.7.0
Description
A denial of service occurs in the
Pkcs12Store.GetCertificateChain() function when an application loads a crafted PKCS#12 file and requests a key entry's certificate chain. An attacker can trigger this by providing certificates whose issuer links form a cycle, such as two certificates where the AuthorityKeyIdentifier extensions identify each other's public key. The issue arises because the chain-building loop only terminates when no issuer is found or a certificate links to itself, failing to track previously visited certificates and following key-identifier links without verifying signatures. This results in an infinite loop that consumes CPU and memory until an OutOfMemoryException is triggered.Recommendations
Update to version 2.7.0 or later.
استغلال
إصلاح
DoS
Infinite Loop
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Bc-Csharp