bouncycastle: An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1....
CVE-2024-34447 is fixed in 14 products on 1 platform, first by DEBIAN-CVE-2024-34447, released May 3, 2024. It is not reported as exploited. Patch Radar priority: High.
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| bouncycastle · Debian 13.5 (trixie) | 1.80-1 | DEBIAN-CVE-2024-34447 | May 3, 2024 |
| bouncycastle · Debian 14 | 1.80-1 | DEBIAN-CVE-2024-34447 | May 3, 2024 |
| bouncycastle · amzn 2023 | 1.70-4.amzn2023.0.5 | ALAS2023-2024-636 | Jun 6, 2024 |
| bouncycastle-javadoc · amzn 2023 | 1.70-4.amzn2023.0.5 | ALAS2023-2024-636 | Jun 6, 2024 |
| bouncycastle-mail · amzn 2023 | 1.70-4.amzn2023.0.5 | ALAS2023-2024-636 | Jun 6, 2024 |
| bouncycastle-pg · amzn 2023 | 1.70-4.amzn2023.0.5 | ALAS2023-2024-636 | Jun 6, 2024 |
| bouncycastle-pkix · amzn 2023 | 1.70-4.amzn2023.0.5 | ALAS2023-2024-636 | Jun 6, 2024 |
| bouncycastle-tls · amzn 2023 | 1.70-4.amzn2023.0.5 | ALAS2023-2024-636 | Jun 6, 2024 |
| bouncycastle-util · amzn 2023 | 1.70-4.amzn2023.0.5 | ALAS2023-2024-636 | Jun 6, 2024 |
| libbcjmail-java · Ubuntu 24.04.5 LTS (noble) | 1.77-1ubuntu0.1~esm1 | libbcjmail-java 1.77-1ubuntu0.1~esm1 | Aug 13, 2025 |
| libbcmail-java · Ubuntu 20.04 LTS (focal) | 1.61-1ubuntu0.1~esm1 | libbcmail-java 1.61-1ubuntu0.1~esm1 | May 14, 2024 |
| libbcmail-java · Ubuntu 22.04.1 LTS (jammy) | 1.68-5ubuntu0.1~esm1 | libbcmail-java 1.68-5ubuntu0.1~esm1 | May 14, 2024 |
| libbcmail-java · Ubuntu 24.04.5 LTS (noble) | 1.77-1ubuntu0.1~esm1 | libbcmail-java 1.77-1ubuntu0.1~esm1 | Aug 13, 2025 |
| libbcpg-java · Ubuntu 20.04 LTS (focal) | 1.61-1ubuntu0.1~esm1 | libbcpg-java 1.61-1ubuntu0.1~esm1 | May 14, 2024 |
| libbcpg-java · Ubuntu 22.04.1 LTS (jammy) | 1.68-5ubuntu0.1~esm1 | libbcpg-java 1.68-5ubuntu0.1~esm1 | May 14, 2024 |
| libbcpg-java · Ubuntu 24.04.5 LTS (noble) | 1.77-1ubuntu0.1~esm1 | libbcpg-java 1.77-1ubuntu0.1~esm1 | Aug 13, 2025 |
| libbcpkix-java · Ubuntu 20.04 LTS (focal) | 1.61-1ubuntu0.1~esm1 | libbcpkix-java 1.61-1ubuntu0.1~esm1 | May 14, 2024 |
| libbcpkix-java · Ubuntu 22.04.1 LTS (jammy) | 1.68-5ubuntu0.1~esm1 | libbcpkix-java 1.68-5ubuntu0.1~esm1 | May 14, 2024 |
| libbcpkix-java · Ubuntu 24.04.5 LTS (noble) | 1.77-1ubuntu0.1~esm1 | libbcpkix-java 1.77-1ubuntu0.1~esm1 | Aug 13, 2025 |
| libbcprov-java · Ubuntu 20.04 LTS (focal) | 1.61-1ubuntu0.1~esm1 | libbcprov-java 1.61-1ubuntu0.1~esm1 | May 14, 2024 |
| libbcprov-java · Ubuntu 22.04.1 LTS (jammy) | 1.68-5ubuntu0.1~esm1 | libbcprov-java 1.68-5ubuntu0.1~esm1 | May 14, 2024 |
| libbcprov-java · Ubuntu 24.04.5 LTS (noble) | 1.77-1ubuntu0.1~esm1 | libbcprov-java 1.77-1ubuntu0.1~esm1 | Aug 13, 2025 |
| libbctls-java · Ubuntu 22.04.1 LTS (jammy) | 1.68-5ubuntu0.1~esm1 | libbctls-java 1.68-5ubuntu0.1~esm1 | May 14, 2024 |
| libbctls-java · Ubuntu 24.04.5 LTS (noble) | 1.77-1ubuntu0.1~esm1 | libbctls-java 1.77-1ubuntu0.1~esm1 | Aug 13, 2025 |
| libbcutil-java · Ubuntu 24.04.5 LTS (noble) | 1.77-1ubuntu0.1~esm1 | libbcutil-java 1.77-1ubuntu0.1~esm1 | Aug 13, 2025 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.