AIKIDO-2026-708054
bcprov-jdk14 is vulnerable to LDAP Injection
69
Medium Risk
This Affects:
bcprov-jdk14TL;DR
The LDAPStoreHelper shipped in the jdk1.4 build concatenates DN-derived values into a DirContext.search() filter without escaping them, so a crafted certificate Subject or Issuer can inject LDAP filter syntax and change which directory entries are returned. Only the jdk1.4 artifact is affected: the main Java build escapes these values in LDAPUtils.parseDN as part of the CVE-2023-33201 fix, but the jdk1.4 source overlay carries its own parseDN and was missed by that fix. The patch adds RFC 2254 filter escaping to the overlay.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use LDAPStoreHelper / X509LDAPCertStoreParameters with name fields from untrusted certificates.
Background info
bcprov-jdk14 is vulnerable to LDAP Injection in versions 0.0.1 - 1.84.0.
How to fix this
Upgrade the org.bouncycastle:bcprov-jdk14 library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant