Threats tagged 'ghsa-98j2-6v39-78w8'

Bouncy Castle for Java FIPS versions prior to 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series), and 2.1.3 (2.1.X series) improperly zeroise sensitive key material using Object.finalize. This finalization approach delays clearing key material, potentially leaving sensitive data in memory longer than intended and causing memory issues under load. The issue affects AES, DESede engines, certain DRBGs, and key parameter classes. Later versions replace finalization with java.lang.ref.Cleaner for timely zeroisation on Java 9 and above. Bouncy Castle for Java (bcprov) and LTS versions are not affected.