This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/solr-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new 6c3cdb916 Commit build products
6c3cdb916 is described below
commit 6c3cdb9169b099970dbb82346c2763341707c5ae
Author: Build Pelican (action) <[email protected]>
AuthorDate: Thu Aug 13 01:14:36 2026 +0000
Commit build products
---
output/feeds/all.atom.xml | 38 +++-
output/feeds/solr/vex.atom.xml | 36 +++-
output/security-dependency-cves.html | 9 +
output/solr.openvex.json | 32 ++++
output/solr.vex.json | 344 +++++++++++++++++++++--------------
output/vex.html | 54 ++++++
6 files changed, 372 insertions(+), 141 deletions(-)
diff --git a/output/feeds/all.atom.xml b/output/feeds/all.atom.xml
index c9b71753c..3087278c0 100644
--- a/output/feeds/all.atom.xml
+++ b/output/feeds/all.atom.xml
@@ -1494,7 +1494,41 @@ Damon Toey (reporter)</p>
<p>Please refer to the Upgrade Notes in the Solr Ref Guide for
information on upgrading from previous Solr versions:</p>
<p><a
href="https://solr.apache.org/guide/solr/9_10/upgrade-notes/solr-upgrade-notes.html">https://solr.apache.org/guide/solr/9_10/upgrade-notes/solr-upgrade-notes.html</a></p>
<p>Please read CHANGELOG.md for a full list of new features, changes and
bugfixes:</p>
-<p><a
href="https://solr.apache.org/9_10_0/changes/Changes.html">https://solr.apache.org/9_10_0/changes/Changes.html</a></p></content><category
term="solr/news"/></entry><entry><title>Apache James MIME4J: header injection
when composing MIME messages</title><link href="/cve-2024-21742.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-0 [...]
+<p><a
href="https://solr.apache.org/9_10_0/changes/Changes.html">https://solr.apache.org/9_10_0/changes/Changes.html</a></p></content><category
term="solr/news"/></entry><entry><title>Bouncy Castle (bcprov): LDAP CertStore
injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</title><link
href="/cve-2023-33201.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name> [...]
+each in a distinct crypto operation:</p>
+<ul>
+<li><strong>CVE-2023-33201</strong> — LDAP injection in the
X.509 <code>CertStore</code> (fixed in 1.74); requires using Bouncy
+ Castle's LDAP-backed <code>CertStore</code> for certificate
lookups.</li>
+<li><strong>CVE-2024-29857</strong> — importing an EC
certificate with crafted F2m parameters causes CPU exhaustion
…</li></ul></summary><content type="html"><p>Four
vulnerabilities in the Bouncy Castle crypto provider
(<code>org.bouncycastle:bcprov-jdk15on</code>),
+each in a distinct crypto operation:</p>
+<ul>
+<li><strong>CVE-2023-33201</strong> — LDAP injection in the
X.509 <code>CertStore</code> (fixed in 1.74); requires using Bouncy
+ Castle's LDAP-backed <code>CertStore</code> for certificate
lookups.</li>
+<li><strong>CVE-2024-29857</strong> — importing an EC
certificate with crafted F2m parameters causes CPU exhaustion
+ (fixed in 1.78); requires parsing/importing an attacker-supplied EC
certificate.</li>
+<li><strong>CVE-2024-30171</strong> — RSA/TLS timing
side-channel ("Marvin"; fixed in 1.78); requires using Bouncy
+ Castle as the <strong>TLS/JSSE provider</strong> with an
attacker able to time RSA handshake responses.</li>
+<li><strong>CVE-2024-30172</strong> — infinite loop
verifying a crafted Ed25519 signature (fixed in 1.78); requires
+ verifying an attacker-supplied Ed25519 signature.</li>
+</ul>
+<p>Solr is <strong>not affected</strong>. Bouncy Castle
(<code>bcprov</code>/<code>bcpkix</code>/<code>bcmail</code>/<code>bcutil</code>)
is bundled only by the
+optional <strong>extraction (Solr Cell)</strong> module, where
Apache Tika / PDFBox use it to handle encrypted or
+digitally-signed PDFs during document parsing. Solr does not use Bouncy Castle
as a security provider
+in any of the ways these CVEs require:</p>
+<ul>
+<li>Solr's TLS is served by the JVM's default JSSE provider,
<strong>not</strong> Bouncy Castle, so the RSA timing
+ side-channel (CVE-2024-30171) has no Solr-reachable surface.</li>
+<li>Solr never configures an LDAP <code>CertStore</code>
(CVE-2023-33201), never imports attacker-supplied EC
+ certificates (CVE-2024-29857), and never verifies standalone Ed25519
signatures (CVE-2024-30172).</li>
+<li>Tika's text/metadata <strong>extraction</strong> does
not exercise TLS, LDAP certificate lookup, EC-certificate
+ import, or Ed25519 signature verification, so even with Solr Cell enabled
none of the vulnerable
+ code paths are reached.</li>
+</ul>
+<p>Solr shipped an affected <code>bcprov-jdk15on</code> via
Solr Cell from 7.3.0 (1.54) through 9.10.1 (1.70) — all
+below the fixed 1.74/1.78. Solr 10.0.0 upgraded the extraction stack to Tika
3.x, whose PDFBox no
+longer bundles Bouncy Castle, so 10.x ships no <code>bcprov</code>
at all. The affected range is therefore
+7.3.0 – 9.10.1. (Solr 9.5–9.6 also briefly bundled a separate
<code>bcprov-jdk18on</code> 1.77 for another
+module, fixed to 1.78.1 in 9.7; the same not-affected reasoning
applies.)</p></content><category
term="solr/vex"/></entry><entry><title>Apache James MIME4J: header injection
when composing MIME messages</title><link href="/cve-2024-21742.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-21742.html</id><summary
type="html"><p>CVE-2024- [...]
used to <strong>compose / write</strong> MIME messages, improper
input validation lets crafted field values inject
unintended headers into the produced message. It affects
<code>apache-mime4j</code> before 0.8.10 (fixed in
0.8.10), and is …</p></summary><content
type="html"><p>CVE-2024-21742 (CVSS 5.3) is a header-injection issue in
Apache James MIME4J: when the library is
@@ -2340,4 +2374,4 @@ in Solr 8.1.0 (2.4.0) and shipped an affected version —
2.4.0, then 2.7.0, the
<p>Please refer to the Upgrade Notes in the Solr Ref Guide for
information on upgrading from previous Solr versions:</p>
<p><a
href="https://solr.apache.org/guide/solr/9_1/upgrade-notes/solr-upgrade-notes.html">https://solr.apache.org/guide/solr/9_1/upgrade-notes/solr-upgrade-notes.html</a></p>
<p>Please read CHANGES.txt for a full list of bugfixes:</p>
-<p><a
href="https://solr.apache.org/9_1_1/changes/Changes.html">https://solr.apache.org/9_1_1/changes/Changes.html</a></p></content><category
term="solr/news"/></entry><entry><title>xercesImpl</title><link
href="/cve-2012-0881.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2012-0881.html</id><content
type="html"><p>Onl [...]
\ No newline at end of file
+<p><a
href="https://solr.apache.org/9_1_1/changes/Changes.html">https://solr.apache.org/9_1_1/changes/Changes.html</a></p></content><category
term="solr/news"/></entry><entry><title>xercesImpl</title><link
href="/cve-2012-0881.html"
rel="alternate"/><published>2022-12-14T00:00:00+00:00</published><updated>2022-12-14T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2022-12-14:/cve-2012-0881.html</id><content
type="html"><p>Onl [...]
\ No newline at end of file
diff --git a/output/feeds/solr/vex.atom.xml b/output/feeds/solr/vex.atom.xml
index 128a43436..487042eb3 100644
--- a/output/feeds/solr/vex.atom.xml
+++ b/output/feeds/solr/vex.atom.xml
@@ -1262,7 +1262,41 @@ is referenced only inside Log4j's own JARs.
Neither Solr nor any of its bundled dependencies ever constructs or logs such
a message.</p>
<p>Because no shipped code can hand a triggering value to the layout,
the vulnerable code path cannot be reached regardless of the configured layout,
-and the Solr community considers this vulnerability
<strong>non-exploitable</strong> in the binary
distribution.</p></content><category
term="solr/vex"/></entry><entry><title>Apache James MIME4J: header injection
when composing MIME messages</title><link href="/cve-2024-21742.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-217 [...]
+and the Solr community considers this vulnerability
<strong>non-exploitable</strong> in the binary
distribution.</p></content><category
term="solr/vex"/></entry><entry><title>Bouncy Castle (bcprov): LDAP CertStore
injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</title><link
href="/cve-2023-33201.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>ta [...]
+each in a distinct crypto operation:</p>
+<ul>
+<li><strong>CVE-2023-33201</strong> — LDAP injection in the
X.509 <code>CertStore</code> (fixed in 1.74); requires using Bouncy
+ Castle's LDAP-backed <code>CertStore</code> for certificate
lookups.</li>
+<li><strong>CVE-2024-29857</strong> — importing an EC
certificate with crafted F2m parameters causes CPU exhaustion
…</li></ul></summary><content type="html"><p>Four
vulnerabilities in the Bouncy Castle crypto provider
(<code>org.bouncycastle:bcprov-jdk15on</code>),
+each in a distinct crypto operation:</p>
+<ul>
+<li><strong>CVE-2023-33201</strong> — LDAP injection in the
X.509 <code>CertStore</code> (fixed in 1.74); requires using Bouncy
+ Castle's LDAP-backed <code>CertStore</code> for certificate
lookups.</li>
+<li><strong>CVE-2024-29857</strong> — importing an EC
certificate with crafted F2m parameters causes CPU exhaustion
+ (fixed in 1.78); requires parsing/importing an attacker-supplied EC
certificate.</li>
+<li><strong>CVE-2024-30171</strong> — RSA/TLS timing
side-channel ("Marvin"; fixed in 1.78); requires using Bouncy
+ Castle as the <strong>TLS/JSSE provider</strong> with an
attacker able to time RSA handshake responses.</li>
+<li><strong>CVE-2024-30172</strong> — infinite loop
verifying a crafted Ed25519 signature (fixed in 1.78); requires
+ verifying an attacker-supplied Ed25519 signature.</li>
+</ul>
+<p>Solr is <strong>not affected</strong>. Bouncy Castle
(<code>bcprov</code>/<code>bcpkix</code>/<code>bcmail</code>/<code>bcutil</code>)
is bundled only by the
+optional <strong>extraction (Solr Cell)</strong> module, where
Apache Tika / PDFBox use it to handle encrypted or
+digitally-signed PDFs during document parsing. Solr does not use Bouncy Castle
as a security provider
+in any of the ways these CVEs require:</p>
+<ul>
+<li>Solr's TLS is served by the JVM's default JSSE provider,
<strong>not</strong> Bouncy Castle, so the RSA timing
+ side-channel (CVE-2024-30171) has no Solr-reachable surface.</li>
+<li>Solr never configures an LDAP <code>CertStore</code>
(CVE-2023-33201), never imports attacker-supplied EC
+ certificates (CVE-2024-29857), and never verifies standalone Ed25519
signatures (CVE-2024-30172).</li>
+<li>Tika's text/metadata <strong>extraction</strong> does
not exercise TLS, LDAP certificate lookup, EC-certificate
+ import, or Ed25519 signature verification, so even with Solr Cell enabled
none of the vulnerable
+ code paths are reached.</li>
+</ul>
+<p>Solr shipped an affected <code>bcprov-jdk15on</code> via
Solr Cell from 7.3.0 (1.54) through 9.10.1 (1.70) — all
+below the fixed 1.74/1.78. Solr 10.0.0 upgraded the extraction stack to Tika
3.x, whose PDFBox no
+longer bundles Bouncy Castle, so 10.x ships no <code>bcprov</code>
at all. The affected range is therefore
+7.3.0 – 9.10.1. (Solr 9.5–9.6 also briefly bundled a separate
<code>bcprov-jdk18on</code> 1.77 for another
+module, fixed to 1.78.1 in 9.7; the same not-affected reasoning
applies.)</p></content><category
term="solr/vex"/></entry><entry><title>Apache James MIME4J: header injection
when composing MIME messages</title><link href="/cve-2024-21742.html"
rel="alternate"/><published>2025-09-07T00:00:00+00:00</published><updated>2025-09-07T00:00:00+00:00</updated><author><name>Solr
Developers</name></author><id>tag:None,2025-09-07:/cve-2024-21742.html</id><summary
type="html"><p>CVE-2024- [...]
used to <strong>compose / write</strong> MIME messages, improper
input validation lets crafted field values inject
unintended headers into the produced message. It affects
<code>apache-mime4j</code> before 0.8.10 (fixed in
0.8.10), and is …</p></summary><content
type="html"><p>CVE-2024-21742 (CVSS 5.3) is a header-injection issue in
Apache James MIME4J: when the library is
diff --git a/output/security-dependency-cves.html
b/output/security-dependency-cves.html
index 172af281b..025aa8583 100644
--- a/output/security-dependency-cves.html
+++ b/output/security-dependency-cves.html
@@ -641,6 +641,15 @@ or contact <a
href="mailto:[email protected]";>[email protected]</a>.</p>
</tr>
<tr>
<td>
+<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-33201";>CVE-2023-33201</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-29857";>CVE-2024-29857</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-30171";>CVE-2024-30171</a>,
<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-30172";>CVE-2024-30172</a>
</td>
+ <td>7.3.0-9.10.1</td>
+ <td>
+ bcprov-jdk15on-1.70.jar </td>
+ <td><span class="cdx-not-affected">not affected</span></td>
+ <td><a href="/vex.html#cve-2023-33201">Bouncy Castle (bcprov): LDAP
CertStore injection, EC/Ed25519 DoS, and RSA/TLS timing side-channel</a></td>
+ </tr>
+ <tr>
+ <td>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2025-48924";>CVE-2025-48924</a>
</td>
<td>9.0.0-9.9.0</td>
<td>
diff --git a/output/solr.openvex.json b/output/solr.openvex.json
index 8e6362b82..675148e56 100644
--- a/output/solr.openvex.json
+++ b/output/solr.openvex.json
@@ -1084,6 +1084,38 @@
"impact_statement": "CVE-2025-48924 is an uncontrolled-recursion issue
in Apache Commons Lang's\n`ClassUtils.getClass(...)`: a very long,
deeply-nested class name can exhaust the stack and\nthrow `StackOverflowError`.
It affects `commons-lang3` from 3.0 up to (but not including) 3.18.0,\nso
dependency scanners flag the `commons-lang3` JAR bundled in Solr 9.x (which
ships versions\n3.12.0 through 3.15.0 across the 9.0\u20139.9 line).\n\nSolr is
**not affected**. The vulnerable `Clas [...]
"status_notes": "Affected Apache Solr versions: 9.0.0-9.9.0."
},
+ {
+ "vulnerability": {
+ "name": "CVE-2023-33201",
+ "aliases": [
+ "CVE-2024-29857",
+ "CVE-2024-30171",
+ "CVE-2024-30172"
+ ]
+ },
+ "products": [
+ {
+ "@id": "pkg:maven/org.bouncycastle/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.bouncycastle/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.bouncycastle/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.bouncycastle/[email protected]"
+ },
+ {
+ "@id": "pkg:maven/org.bouncycastle/[email protected]"
+ }
+ ],
+ "status": "not_affected",
+ "timestamp": "2025-09-07T00:00:00Z",
+ "justification": "vulnerable_code_not_in_execute_path",
+ "impact_statement": "Four vulnerabilities in the Bouncy Castle crypto
provider (`org.bouncycastle:bcprov-jdk15on`),\neach in a distinct crypto
operation:\n\n* **CVE-2023-33201** \u2014 LDAP injection in the X.509
`CertStore` (fixed in 1.74); requires using Bouncy\n Castle's LDAP-backed
`CertStore` for certificate lookups.\n* **CVE-2024-29857** \u2014 importing an
EC certificate with crafted F2m parameters causes CPU exhaustion\n (fixed in
1.78); requires parsing/importing an atta [...]
+ "status_notes": "Affected Apache Solr versions: 7.3.0-9.10.1."
+ },
{
"vulnerability": {
"name": "CVE-2024-21742"
diff --git a/output/solr.vex.json b/output/solr.vex.json
index 0d263f1ee..eb5c10204 100644
--- a/output/solr.vex.json
+++ b/output/solr.vex.json
@@ -7,7 +7,7 @@
"name": "solr",
"version": "SNAPSHOT",
"type": "application",
- "bom-ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "bom-ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
},
"vulnerabilities": [
@@ -23,7 +23,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -39,7 +39,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -55,7 +55,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -71,7 +71,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -87,7 +87,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -103,7 +103,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -119,7 +119,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -135,7 +135,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -151,7 +151,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -167,7 +167,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -183,7 +183,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -199,7 +199,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -215,7 +215,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -231,7 +231,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -247,7 +247,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -263,7 +263,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -279,7 +279,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -295,7 +295,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -311,7 +311,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -327,7 +327,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -343,7 +343,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -359,7 +359,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -375,7 +375,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -391,7 +391,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -407,7 +407,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -423,7 +423,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -439,7 +439,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -455,7 +455,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -471,7 +471,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -487,7 +487,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -503,7 +503,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -519,7 +519,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -535,7 +535,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -551,7 +551,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -567,7 +567,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -583,7 +583,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -599,7 +599,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -615,7 +615,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -631,7 +631,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -647,7 +647,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -663,7 +663,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -679,7 +679,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -695,7 +695,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -711,7 +711,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -727,7 +727,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -743,7 +743,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -759,7 +759,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -775,7 +775,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -791,7 +791,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -807,7 +807,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -823,7 +823,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -839,7 +839,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -855,7 +855,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -871,7 +871,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -887,7 +887,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -903,7 +903,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -919,7 +919,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -935,7 +935,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -951,7 +951,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -970,7 +970,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -986,7 +986,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1002,7 +1002,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1018,7 +1018,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1037,7 +1037,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1053,7 +1053,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1070,7 +1070,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1087,7 +1087,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1104,7 +1104,75 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2023-33201",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33201";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "Four vulnerabilities in the Bouncy Castle crypto provider
(`org.bouncycastle:bcprov-jdk15on`),\neach in a distinct crypto operation:\n\n*
**CVE-2023-33201** \u2014 LDAP injection in the X.509 `CertStore` (fixed in
1.74); requires using Bouncy\n Castle's LDAP-backed `CertStore` for
certificate lookups.\n* **CVE-2024-29857** \u2014 importing an EC certificate
with crafted F2m parameters causes CPU exhaustion\n (fixed in 1.78); requires
parsing/importing an attacker-sup [...]
+ },
+ "affects": [
+ {
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2024-29857",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29857";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "Four vulnerabilities in the Bouncy Castle crypto provider
(`org.bouncycastle:bcprov-jdk15on`),\neach in a distinct crypto operation:\n\n*
**CVE-2023-33201** \u2014 LDAP injection in the X.509 `CertStore` (fixed in
1.74); requires using Bouncy\n Castle's LDAP-backed `CertStore` for
certificate lookups.\n* **CVE-2024-29857** \u2014 importing an EC certificate
with crafted F2m parameters causes CPU exhaustion\n (fixed in 1.78); requires
parsing/importing an attacker-sup [...]
+ },
+ "affects": [
+ {
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2024-30171",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30171";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "Four vulnerabilities in the Bouncy Castle crypto provider
(`org.bouncycastle:bcprov-jdk15on`),\neach in a distinct crypto operation:\n\n*
**CVE-2023-33201** \u2014 LDAP injection in the X.509 `CertStore` (fixed in
1.74); requires using Bouncy\n Castle's LDAP-backed `CertStore` for
certificate lookups.\n* **CVE-2024-29857** \u2014 importing an EC certificate
with crafted F2m parameters causes CPU exhaustion\n (fixed in 1.78); requires
parsing/importing an attacker-sup [...]
+ },
+ "affects": [
+ {
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
+ }
+ ]
+ },
+ {
+ "id": "CVE-2024-30172",
+ "source": {
+ "name": "NVD",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30172";
+ },
+ "analysis": {
+ "state": "not_affected",
+ "justification": "code_not_reachable",
+ "detail": "Four vulnerabilities in the Bouncy Castle crypto provider
(`org.bouncycastle:bcprov-jdk15on`),\neach in a distinct crypto operation:\n\n*
**CVE-2023-33201** \u2014 LDAP injection in the X.509 `CertStore` (fixed in
1.74); requires using Bouncy\n Castle's LDAP-backed `CertStore` for
certificate lookups.\n* **CVE-2024-29857** \u2014 importing an EC certificate
with crafted F2m parameters causes CPU exhaustion\n (fixed in 1.78); requires
parsing/importing an attacker-sup [...]
+ },
+ "affects": [
+ {
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1121,7 +1189,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1138,7 +1206,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1155,7 +1223,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1172,7 +1240,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1189,7 +1257,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1206,7 +1274,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1223,7 +1291,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1243,7 +1311,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1263,7 +1331,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1283,7 +1351,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1300,7 +1368,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1320,7 +1388,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1337,7 +1405,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1354,7 +1422,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1371,7 +1439,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1388,7 +1456,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1405,7 +1473,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1422,7 +1490,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1439,7 +1507,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1456,7 +1524,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1473,7 +1541,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1490,7 +1558,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1507,7 +1575,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1524,7 +1592,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1541,7 +1609,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1558,7 +1626,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1575,7 +1643,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1592,7 +1660,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1609,7 +1677,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1626,7 +1694,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1643,7 +1711,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1660,7 +1728,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1677,7 +1745,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1694,7 +1762,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1711,7 +1779,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1728,7 +1796,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1745,7 +1813,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1762,7 +1830,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1779,7 +1847,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1796,7 +1864,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1813,7 +1881,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1830,7 +1898,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1847,7 +1915,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1864,7 +1932,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1881,7 +1949,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1898,7 +1966,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1915,7 +1983,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1932,7 +2000,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1949,7 +2017,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1966,7 +2034,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -1983,7 +2051,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2000,7 +2068,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2017,7 +2085,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2034,7 +2102,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2051,7 +2119,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2068,7 +2136,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2085,7 +2153,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2102,7 +2170,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2119,7 +2187,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2136,7 +2204,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2153,7 +2221,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2170,7 +2238,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2187,7 +2255,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2204,7 +2272,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2221,7 +2289,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2238,7 +2306,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2255,7 +2323,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2272,7 +2340,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
},
@@ -2289,7 +2357,7 @@
},
"affects": [
{
- "ref": "75e322e1-bbc5-5a46-828d-fe2eca0bbff1"
+ "ref": "27096e1b-e0a8-5e74-830f-70e9ee0d0a58"
}
]
}
diff --git a/output/vex.html b/output/vex.html
index 5871835c9..3da5baf4c 100644
--- a/output/vex.html
+++ b/output/vex.html
@@ -2323,6 +2323,60 @@ extraction in a separate Tika service, or replace
<code>modules/extraction/lib/a
<li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-21742";>CVE-2024-21742</a></li>
</ul>
</article>
+ <article id="cve-2023-33201" class="post panel radius">
+ <header class="post-header">
+ <h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-33201";>CVE-2023-33201</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-29857";>CVE-2024-29857</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-30171";>CVE-2024-30171</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-30172";>CVE-2024-30172</a>,
Bouncy Castle (bcprov): LDAP CertStore injection, EC/Ed25519 DoS, and RSA/TLS
timing side-channel</h3>
+ <div class="panel callout">
+ <p class="subheader">
+ <strong>Published:</strong>
+ <time
datetime="2025-09-07T00:00:00+00:00">2025-09-07</time>
+ </p>
+ <p class="subheader">
+ <strong>Status:</strong>
+ <span class="cdx-not-affected">not_affected</span>
+ </p>
+ <p class="subheader"><strong>Affected Solr
versions:</strong> 7.3.0-9.10.1</p>
+ </div>
+ </header>
+
+ <h4>Description</h4>
+ <p>Four vulnerabilities in the Bouncy Castle crypto provider
(<code>org.bouncycastle:bcprov-jdk15on</code>),
+each in a distinct crypto operation:</p>
+<ul>
+<li><strong>CVE-2023-33201</strong> — LDAP injection in the X.509
<code>CertStore</code> (fixed in 1.74); requires using Bouncy
+ Castle's LDAP-backed <code>CertStore</code> for certificate lookups.</li>
+<li><strong>CVE-2024-29857</strong> — importing an EC certificate with crafted
F2m parameters causes CPU exhaustion
+ (fixed in 1.78); requires parsing/importing an attacker-supplied EC
certificate.</li>
+<li><strong>CVE-2024-30171</strong> — RSA/TLS timing side-channel ("Marvin";
fixed in 1.78); requires using Bouncy
+ Castle as the <strong>TLS/JSSE provider</strong> with an attacker able to
time RSA handshake responses.</li>
+<li><strong>CVE-2024-30172</strong> — infinite loop verifying a crafted
Ed25519 signature (fixed in 1.78); requires
+ verifying an attacker-supplied Ed25519 signature.</li>
+</ul>
+<p>Solr is <strong>not affected</strong>. Bouncy Castle
(<code>bcprov</code>/<code>bcpkix</code>/<code>bcmail</code>/<code>bcutil</code>)
is bundled only by the
+optional <strong>extraction (Solr Cell)</strong> module, where Apache Tika /
PDFBox use it to handle encrypted or
+digitally-signed PDFs during document parsing. Solr does not use Bouncy Castle
as a security provider
+in any of the ways these CVEs require:</p>
+<ul>
+<li>Solr's TLS is served by the JVM's default JSSE provider,
<strong>not</strong> Bouncy Castle, so the RSA timing
+ side-channel (CVE-2024-30171) has no Solr-reachable surface.</li>
+<li>Solr never configures an LDAP <code>CertStore</code> (CVE-2023-33201),
never imports attacker-supplied EC
+ certificates (CVE-2024-29857), and never verifies standalone Ed25519
signatures (CVE-2024-30172).</li>
+<li>Tika's text/metadata <strong>extraction</strong> does not exercise TLS,
LDAP certificate lookup, EC-certificate
+ import, or Ed25519 signature verification, so even with Solr Cell enabled
none of the vulnerable
+ code paths are reached.</li>
+</ul>
+<p>Solr shipped an affected <code>bcprov-jdk15on</code> via Solr Cell from
7.3.0 (1.54) through 9.10.1 (1.70) — all
+below the fixed 1.74/1.78. Solr 10.0.0 upgraded the extraction stack to Tika
3.x, whose PDFBox no
+longer bundles Bouncy Castle, so 10.x ships no <code>bcprov</code> at all. The
affected range is therefore
+7.3.0 – 9.10.1. (Solr 9.5–9.6 also briefly bundled a separate
<code>bcprov-jdk18on</code> 1.77 for another
+module, fixed to 1.78.1 in 9.7; the same not-affected reasoning applies.)</p>
+
+ <h4>References</h4>
+ <ul>
+ <li>JIRA: <a
href="https://issues.apache.org/jira/browse/SOLR-17899";>SOLR-17899</a></li>
+ <li>CVE: <a
href="https://nvd.nist.gov/vuln/detail/CVE-2023-33201";>CVE-2023-33201</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-29857";>CVE-2024-29857</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-30171";>CVE-2024-30171</a>, <a
href="https://nvd.nist.gov/vuln/detail/CVE-2024-30172";>CVE-2024-30172</a></li>
+ </ul>
+ </article>
<article id="cve-2025-48924" class="post panel radius">
<header class="post-header">
<h3 class="title"><a
href="https://nvd.nist.gov/vuln/detail/CVE-2025-48924";>CVE-2025-48924</a>,
Apache Commons Lang: uncontrolled recursion in ClassUtils.getClass</h3>
