AIKIDO-2026-912141
bcjmail-jdk15to18 is vulnerable to Improper Certificate Validation
87
High Risk
This Affects:
bcjmail-jdk15to18TL;DR
The S/MIME signed-message validator in the mail module uses the signingTime value carried inside the CMS signed attributes as the reference date for PKIX certificate path validation. Because that attribute is asserted by the message signer and is not bound to a trusted time source, a signer can supply an arbitrary time so that an expired or revoked signing certificate is treated as valid. Signed messages then pass validation against certificates that should be rejected, so SignedMailValidator reports a trusted result for messages it should refuse. The fix makes a caller-provided validation date take precedence over the signer-asserted signingTime.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use SignedMailValidator to verify S/MIME signed messages whose signingTime signed attribute is externally supplied by the message signer.
Background info
bcjmail-jdk15to18 is vulnerable to Improper Certificate Validation in versions 0.0.1 - 1.84.0.
How to fix this
Upgrade the org.bouncycastle:bcjmail-jdk15to18 library to the patch version, then set an explicit validation date on the PKIXParameters you pass to SignedMailValidator (for example the current time). Without a caller-supplied date the patched version still falls back to the signer-asserted signingTime.
Links
Fix Commits
github.com/bcgit/bc-java/commit/2f81b22d559b3a1b026388e1ca78dd547384def8github.com/bcgit/bc-java/commit/fd89fe918b37fea1c71e95fae50284a325b09721
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant