Detections
Analytics

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2026-3405)

high Nessus Plugin ID 377905

Synopsis

The remote Amazon Linux 2023 host is missing a security update.

Description

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3405 advisory.

 In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12. (CVE-2026-12185)

 In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption.
 This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC- FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
 (CVE-2026-12802)

 In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split.
 This issue also affects Bouncy Castle for Java LTS before 2.73.12. (CVE-2026-12816)

 In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12. (CVE-2026-12860)

 In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS).
 This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC- FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
 (CVE-2026-13586)

 In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input.
 This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC- FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
 (CVE-2026-15055)

 In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file.
 This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC- FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
 (CVE-2026-58063)

 In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). (CVE-2026-59647)

 In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key.
 This issue also affects Bouncy Castle for Java LTS before 2.73.12. (CVE-2026-59651)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'dnf update bouncycastle --releasever 2023.12.20261109' or or 'dnf update --advisory ALAS2023-2026-3405 --releasever 2023.12.20261109' to update your system.

See Also

https://alas.aws.amazon.com//AL2023/ALAS2023-2026-3405.html

https://alas.aws.amazon.com/faqs.html

https://explore.alas.aws.amazon.com/CVE-2026-12185.html

https://explore.alas.aws.amazon.com/CVE-2026-12802.html

https://explore.alas.aws.amazon.com/CVE-2026-12816.html

https://explore.alas.aws.amazon.com/CVE-2026-12860.html

https://explore.alas.aws.amazon.com/CVE-2026-13586.html

https://explore.alas.aws.amazon.com/CVE-2026-15055.html

https://explore.alas.aws.amazon.com/CVE-2026-58063.html

https://explore.alas.aws.amazon.com/CVE-2026-59647.html

https://explore.alas.aws.amazon.com/CVE-2026-59651.html

Plugin Details

Severity: High

ID: 377905

File Name: al2023_ALAS2023-2026-3405.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/9/2026

Updated: 11/9/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.55

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C

CVSS Score Source: CVE-2026-12185

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-12860

Vulnerability Information

CPE: cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:bouncycastle-javadoc, p-cpe:/a:amazon:linux:bouncycastle-mail, p-cpe:/a:amazon:linux:bouncycastle-pg, p-cpe:/a:amazon:linux:bouncycastle-pkix, p-cpe:/a:amazon:linux:bouncycastle-tls, p-cpe:/a:amazon:linux:bouncycastle-util, p-cpe:/a:amazon:linux:bouncycastle

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/9/2026

Vulnerability Publication Date: 8/3/2026

Reference Information

CVE: CVE-2026-12185, CVE-2026-12802, CVE-2026-12816, CVE-2026-12860, CVE-2026-13586, CVE-2026-15055, CVE-2026-58063, CVE-2026-59647, CVE-2026-59651