CVE-2019-17359

Published: Oct 8, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.

Affected (34)

Products: Bouncycastle: Bc Java · Apache: Tomee · Netapp: Active Iq Unified Manager, Oncommand Api Services, Oncommand Workflow Automation, Service Level Manager · +1 more

Show all products

1 product

1 product

4 products

Active Iq Unified Manager

Oncommand Api Services

Oncommand Workflow Automation

Service Level Manager

15 products

Business Process Management Suite

Communications Convergence

Communications Diameter Signaling Router

Communications Session Route Manager

Data Integrator

Financial Services Analytical Applications Infrastructure

Flexcube Private Banking

Hospitality Guest Access

Managed File Transfer

Peoplesoft Enterprise Hcm Global Payroll Switzerland

Peoplesoft Enterprise Peopletools

Retail Xstore Point Of Service

Webcenter Portal

Weblogic Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Bouncycastle Bc Java	Version 1.63

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Apache Tomee	Version 7.0.7
Apache Tomee	Version 7.1.2
Apache Tomee	Version 8.0.1

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	From 7.3
Netapp Active Iq Unified Manager	From 9.5
Netapp Active Iq Unified Manager	From 7.3
Netapp Oncommand Api Services	All versions
Netapp Oncommand Workflow Automation	All versions
Netapp Service Level Manager	All versions

Configuration D

24 vulnerable

Vulnerable Software	Affected Versions
Oracle Business Process Management Suite	Version 12.2.1.3.0
Oracle Business Process Management Suite	Version 12.2.1.4.0
Oracle Communications Convergence	From 3.0.1.0 to 3.0.2.1
Oracle Communications Diameter Signaling Router	From 8.0.0 to 8.2.2
Oracle Communications Session Route Manager	From 8.2.0 to 8.2.2
Oracle Data Integrator	Version 12.2.1.4.0
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.6 to 8.0.9
Oracle Flexcube Private Banking	Version 12.0.0
Oracle Flexcube Private Banking	Version 12.1.0
Oracle Hospitality Guest Access	Version 4.2.0
Oracle Managed File Transfer	Version 12.2.1.3.0
Oracle Managed File Transfer	Version 12.2.1.4.0
Oracle Peoplesoft Enterprise Hcm Global Payroll Switzerland	Version 9.2
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Retail Xstore Point Of Service	Version 18.0.1
Oracle Soa Suite	Version 12.2.1.3.0
Oracle Soa Suite	Version 12.2.1.4.0
Oracle Webcenter Portal	Version 11.1.1.9.0
Oracle Webcenter Portal	Version 12.2.1.3.0
Oracle Webcenter Portal	Version 12.2.1.4.0
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (32)

https://lists.apache.org/thread.html/r02f887807a49cfd1f1ad53f7a61f3f8e12f60ba2c930bec163031209%40%3Ccommits.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r16c3a90cb35ae8a9c74fd5c813c16d6ac255709c9f9d71cd409e007d%40%3Ccommits.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r467ade3fef3493f1fff1a68a256d087874e1f858ad1de7a49fe05d27%40%3Ccommits.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r4d475dcaf4f57115fa57d8e06c3823ca398b35468429e7946ebaefdc%40%3Ccommits.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r79b6a6aa0dd1aeb57bd253d94794bc96f1ec005953c4bd5414cc0db0%40%3Ccommits.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r8ecb5b76347f84b6e3c693f980dbbead88c25f77b815053c4e6f2c30%40%3Ccommits.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r91b07985b1307390a58c5b9707f0b28ef8e9c9e1c86670459f20d601%40%3Ccommits.tomee.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/re60f980c092ada4bfe236dcfef8b6ca3e8f3b150fc0f51b8cc13d59d%40%3Ccommits.tomee.apache.org%3E

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20191024-0006/

Source: cve@mitre.org

Third Party Advisory

https://www.bouncycastle.org/latest_releases.html

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.bouncycastle.org/releasenotes.html

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.apache.org/thread.html/r02f887807a49cfd1f1ad53f7a61f3f8e12f60ba2c930bec163031209%40%3Ccommits.tomee.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r16c3a90cb35ae8a9c74fd5c813c16d6ac255709c9f9d71cd409e007d%40%3Ccommits.tomee.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r467ade3fef3493f1fff1a68a256d087874e1f858ad1de7a49fe05d27%40%3Ccommits.tomee.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r4d475dcaf4f57115fa57d8e06c3823ca398b35468429e7946ebaefdc%40%3Ccommits.tomee.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r79b6a6aa0dd1aeb57bd253d94794bc96f1ec005953c4bd5414cc0db0%40%3Ccommits.tomee.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r8ecb5b76347f84b6e3c693f980dbbead88c25f77b815053c4e6f2c30%40%3Ccommits.tomee.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r91b07985b1307390a58c5b9707f0b28ef8e9c9e1c86670459f20d601%40%3Ccommits.tomee.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/re60f980c092ada4bfe236dcfef8b6ca3e8f3b150fc0f51b8cc13d59d%40%3Ccommits.tomee.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20191024-0006/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.bouncycastle.org/latest_releases.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://www.bouncycastle.org/releasenotes.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.