Bug 2510201 (CVE-2026-59638)
| Summary: | CVE-2026-59638 org.bouncycastle/bctls-jdk15on: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Improper hostname validation due to default CN-fallback in JSSE verifier | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | amctagga, anthomas, ant, anujha, aoconnor, aschwart, asoldano, aszczucz, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, bniver, boliveir, bstansbe, cescoffi, dandread, dbruscin, dfreiber, dkreling, dlofthou, drichtar, drow, dschmidt, eglynn, ehelms, ehugonne, ewittman, flucifre, fmariani, fmongiar, gbenhaim, ggainey, gmalinko, gmeno, groman, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jjoyce, jlanda, jmartisk, jnethert, jpasqual, jpretori, jschluet, juwatts, jwon, kshier, kvanderr, lhh, lthon, manderse, mbenjamin, mburns, mcarlett, mdellweg, mgarciac, mhackett, mhulan, mosmerov, mposolda, msvehla, nipatil, niyer, nmoumoul, nwallace, olubyans, osousa, pantinor, pberan, pcreech, pdelbell, pesilva, pgallagh, pjindal, pmackay, probinso, rchan, rguimara, rhel-process-autobot, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sbiarozk, sdawley, simaishi, smallamp, sostapov, ssilvert, stcannon, sthorger, tcunning, teagle, thjenkin, tmalecek, tqvarnst, twaugh, vdosoudi, vereddy, vkumar, vmuzikar, watson-tool-maintainers, yfang, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Bouncy Castle for Java. The Java Secure Socket Extension (JSSE) hostname verifier incorrectly enables the Common Name (CN) fallback by default, despite it being documented as an opt-in feature. This misconfiguration could allow a remote attacker to bypass proper hostname validation by presenting a specially crafted certificate during a TLS (Transport Layer Security) handshake. As a result, an attacker might be able to impersonate a legitimate server, leading to potential man-in-the-middle attacks and information disclosure.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2533156, 2533157 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-08-03 02:01:55 UTC
|