# CVE-2024-34447: Bouncy Castle Java Cryptography API vulnerable to DNS poisoning

> CVE-2024-34447 (GitHub advisory GHSA-4h8f-2wvx-gg5w) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.9, classed as Improper Validation of Certificate with Host Mismatch (CWE-297), in 7 packages, including org.bouncycastle:bcprov-jdk18on (Maven) and org.bouncycastle:bcprov-jdk15to18 (Maven). Fixed versions: org.bouncycastle:bcprov-jdk18on 1.78; org.bouncycastle:bcprov-jdk15to18 1.78; and 5 more packages.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2024-34447

| Field | Value |
| --- | --- |
| CVE | CVE-2024-34447 |
| GHSA | GHSA-4h8f-2wvx-gg5w |
| Severity | Medium |
| CVSS 3.1 | 5.9 `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N` (GitHub Advisory Database) |
| CVSS 3.1 | 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` (CVE.org) |
| CWE | CWE-297 Improper Validation of Certificate with Host Mismatch |
| EPSS | 0.77% (higher than 53% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact partial |
| Published | 3 May 2024 |
| Modified | 17 Apr 2026 |

## Description

An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| org.bouncycastle:bcprov-jdk18on | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk18on` | >= 1.61, < 1.78 | 1.78 |
| org.bouncycastle:bcprov-jdk15to18 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk15to18` | >= 1.61, < 1.78 | 1.78 |
| org.bouncycastle:bcprov-jdk14 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk14` | >= 1.61, < 1.78 | 1.78 |
| org.bouncycastle:bcprov-jdk12 | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk12` | >= 1.61, < 1.78 | 1.78 |
| org.bouncycastle:bctls-fips | Maven | `pkg:maven/org.bouncycastle/bctls-fips` | < 1.0.19 | 1.0.19 |
| org.bouncycastle:bcprov-lts8on | Maven | `pkg:maven/org.bouncycastle/bcprov-lts8on` | < 2.73.6 | 2.73.6 |
| org.bouncycastle:bcprov-jdk15on | Maven | `pkg:maven/org.bouncycastle/bcprov-jdk15on` | >= 1.61, < 1.78 | 1.78 |

## Questions

**What is the GHSA ID for CVE-2024-34447?**

GitHub tracks CVE-2024-34447 as GHSA-4h8f-2wvx-gg5w.

**What is the CVSS score of CVE-2024-34447?**

CVE-2024-34447 has a CVSS 3.1 base score of 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. Other published scores: CVSS 3.1 7.5.

**Which versions are affected by CVE-2024-34447?**

org.bouncycastle:bcprov-jdk18on (Maven): >= 1.61, < 1.78. org.bouncycastle:bcprov-jdk15to18 (Maven): >= 1.61, < 1.78. org.bouncycastle:bcprov-jdk14 (Maven): >= 1.61, < 1.78. org.bouncycastle:bcprov-jdk12 (Maven): >= 1.61, < 1.78. org.bouncycastle:bctls-fips (Maven): < 1.0.19. org.bouncycastle:bcprov-lts8on (Maven): < 2.73.6. 1 more packages are listed on the page.

**How do I fix CVE-2024-34447?**

Upgrade each package to its fixed version: org.bouncycastle:bcprov-jdk18on 1.78; org.bouncycastle:bcprov-jdk15to18 1.78; org.bouncycastle:bcprov-jdk14 1.78; org.bouncycastle:bcprov-jdk12 1.78; and 3 more packages.

**What is the Package URL (PURL) for CVE-2024-34447?**

The affected packages' PURLs are pkg:maven/org.bouncycastle/bcprov-jdk18on, pkg:maven/org.bouncycastle/bcprov-jdk15to18, pkg:maven/org.bouncycastle/bcprov-jdk14, pkg:maven/org.bouncycastle/bcprov-jdk12, pkg:maven/org.bouncycastle/bctls-fips and pkg:maven/org.bouncycastle/bcprov-lts8on and more.

**Is CVE-2024-34447 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2024-34447. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 53% of CVEs.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2024-34447 (advisory)
- http://security.netapp.com/advisory/ntap-20240614-0007 (advisory)
- https://github.com/advisories/GHSA-4h8f-2wvx-gg5w (advisory)
- https://github.com/bcgit/bc-java/issues/1656 (report)
- https://github.com/bcgit/bc-java (package)
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902024%E2%80%9034447
- https://www.bouncycastle.org/latest_releases.html

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2024-34447), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.