AIKIDO-2026-956848
bcmail-jdk18on is vulnerable to Improper Certificate Validation
87
High Risk
This Affects:
bcmail-jdk18onTL;DR
The S/MIME signature validator uses the signer-asserted signingTime attribute carried inside a CMS signed message as the date for PKIX certificate path validation. Because that timestamp originates from the signed message itself, it is not authenticated and can be back-dated. A holder of an expired or revoked signing certificate can set signingTime to a moment when the certificate was still valid, so certificate expiry and revocation checks pass during validation. The fix makes a validation date explicitly supplied on PKIXParameters take precedence over the asserted signingTime, so callers can pin a trusted instant.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the S/MIME SignedMailValidator to verify signed messages whose signingTime attribute is externally supplied by the message signer.
Background info
bcmail-jdk18on is vulnerable to Improper Certificate Validation in versions 0.0.1 - 1.84.0.
How to fix this
Upgrade the org.bouncycastle:bcmail-jdk18on library to the patch version, then set an explicit validation date on the PKIXParameters you pass to SignedMailValidator (for example the current time). Without a caller-supplied date the patched version still falls back to the signer-asserted signingTime.
Links
Fix Commits
github.com/bcgit/bc-java/commit/2f81b22d559b3a1b026388e1ca78dd547384def8github.com/bcgit/bc-java/commit/fd89fe918b37fea1c71e95fae50284a325b09721
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant