AIKIDO-2026-413486
bcjmail-jdk18on is vulnerable to Improper Certificate Validation
87
High Risk
This Affects:
bcjmail-jdk18onTL;DR
The S/MIME message validator selects the certificate path validation date from the signer-supplied signingTime attribute carried inside the signed message. Because that attribute is asserted by the signer and is not independently authenticated, it can be back-dated to a moment when an otherwise expired or revoked signing certificate was still valid. Signed messages then pass validation even though the signing certificate should be rejected, weakening the trust decision for signed mail. The fix makes a validation date explicitly supplied on PKIXParameters authoritative instead of the asserted signingTime.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the S/MIME SignedMailValidator to validate signed messages whose signingTime attribute is externally supplied by the message signer.
Background info
bcjmail-jdk18on is vulnerable to Improper Certificate Validation in versions 0.0.1 - 1.84.0.
How to fix this
Upgrade the org.bouncycastle:bcjmail-jdk18on library to the patch version, then set an explicit validation date on the PKIXParameters you pass to SignedMailValidator (for example the current time). Without a caller-supplied date the patched version still falls back to the signer-asserted signingTime.
Links
Fix Commits
github.com/bcgit/bc-java/commit/2f81b22d559b3a1b026388e1ca78dd547384def8github.com/bcgit/bc-java/commit/fd89fe918b37fea1c71e95fae50284a325b09721
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant