Threats tagged 'ghsa-v6w3-qrh8-qccc'

Bouncy Castle for Java FIPS (bc-fips) versions 2.1.0 through 2.1.2 contain a vulnerability in the native entropy source on Intel platforms. The issue causes unbounded retry loops when CPU entropy instructions RDSEED and RDRAND fail, leading to indefinite hangs in the JNI seeding routine. This denial of service occurs because the retry loop spins without interruption or timeout if the entropy source fails persistently. The vulnerability was fixed in version 2.1.3 by bounding retry attempts, adding pauses, and throwing exceptions on exhaustion.