Bouncy Castle BKS-V1 is prone to a security weakness.
Successfully exploiting this issue will allow attackers to perform unauthorized actions; this may aid in launching further attacks.
Information
Exploit
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
References:
- The Curious Case of the Bouncy Castle BKS Passwords (insights.sei.cmu.edu)
- Bouncy Castle Homepage (Bouncy Castle)
- Release Notes (bouncycastle)
- VU#306792: Bouncy Castle BKS-V1 keystore files vulnerable to trivial hash collis (kb.cert)