CVE-2026-71888— CMS 认证数据暴露攻击者插入的authAttrs
一分钟漏洞结论
影响对象
Legion of the Bouncy Castle Inc. BC-JAVA
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Bouncy Castle for Java 1.86 之前的版本中，流式 CMS AuthenticatedData（认证数据）解析器接受了一条消息，其 （摘要算法）和 （认证属性）字段在是否包含认证属性上存在不一致。根据 RFC 5652 第 9.1 节，这两个字段应当配对使用：只要存在 ，就必须存在 ；而第 9.2 节规定，当存在 时，MAC（消息认证码）应覆盖 的 DER 编码；当不存在 时，MAC 则直接覆盖 （内容）OCTET STRING。 由于 必须在构造函数中决定采用哪种 MAC 验证方式，而
可能的 ATT&CK 技术 1 AI
T1562
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-71888 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent
来源: CVE Program / CVE List V5
Vulnerability Description
In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever digestAlgorithm is, and sec. 9.2 makes the MAC cover the DER encoding of authAttrs when they are present and the eContent OCTET STRING directly when they are not. CMSAuthenticatedDataParser has to choose between those two in its constructor, before it can reach authAttrs, which comes later in the SEQUENCE, so it chose on digestAlgorithm alone: for a message with digestAlgorithm absent but authAttrs present it verified the content MAC and then returned the attributes through getAuthAttrs() as though they had been authenticated, when the MAC had never covered them. An attacker able to modify a message in transit could insert an authenticated attribute, such as an RFC 2634 ESSSecurityLabel, into an otherwise valid message while holding neither the key-encryption key nor the content-MAC key, and an application taking an authorization, routing or labelling decision from those attributes would act on attacker-chosen values. The content itself remained MAC-bound. asn1.cms.AuthenticatedData now rejects the mismatched pairing when parsing and CMSAuthenticatedDataParser cross-checks the two fields once authAttrs is read. This is a variant of CVE-2026-59642, which bound the content to the MAC for messages that legitimately carry authAttrs, and which does not address this case. This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series), and bcutil-fips 2.0.8 (2.0.X series) and 2.1.8 (2.1.X series).
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber
来源: CVE Program / CVE List V5
Vulnerability Type
完整性检查值验证不恰当
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Legion of the Bouncy Castle Inc. | BC-JAVA | 0 ~ 1.86 | - |
|
| Legion of the Bouncy Castle Inc. | BC-JAVA | 1.70 ~ 1.86 | - |
|
| Legion of the Bouncy Castle Inc. | BC-LTS-JAVA | 2.73.0 ~ 2.73.13 | - |
|
| Legion of the Bouncy Castle Inc. | BC-LTS-JAVA | 2.73.0 ~ 2.73.13 | - |
|
| Legion of the Bouncy Castle Inc. | BC-FJA | 1.0.0 ~ 1.0.13 | - |
|
| Legion of the Bouncy Castle Inc. | BC-FJA | 2.0.0 ~ 2.0.8 | - |
|
二、漏洞 CVE-2026-71888 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-71888 的情报信息
请登录查看更多情报信息。
CVE-2026-71888 补丁与修复 (1)
CVE-2026-71888 新闻报道 (1)
-
🔗 CVE‐2026‐71888 · bcgit/bc-java Wiki · GitHub vendor-advisory
同批安全公告 · Legion of the Bouncy Castle Inc. · 2026-10-03 · 共 12 条
| CVE-2026-71885 | 9.2 CRITICAL | MLS X.509凭证未绑定到LeafNode签名密钥 |
| CVE-2026-71889 | 8.7 HIGH | PKIXCertPathReviewer X.509名称约束绕过漏洞 |
| CVE-2026-71890 | 8.7 HIGH | MLS外部提交可移除任意组成员漏洞 |
| CVE-2026-85515 | 8.2 HIGH | OpenPGP消息截断未报告，绕过SEIPDv1完整性检查 |
| CVE-2026-71887 | 8.2 HIGH | OpenPGP 签名子键无交叉认证漏洞 |
| CVE-2026-71883 | 8.2 HIGH | Native AES密文解析器泄露原始AES密钥 |
| CVE-2026-71886 | 8.2 HIGH | OpenPGP 子键无证书认证漏洞 |
| CVE-2026-71891 | 7.1 HIGH | BLS12-381 密钥验证接受基于外部曲线的公钥 |
| CVE-2026-71892 | 6.9 MEDIUM | RFC 9709 HKDF派生密钥未执行CMS密钥传输接收方密钥大小验证 |
| CVE-2026-18040 | 5.9 MEDIUM | HQC 通过秘密索引表和采样器泄露私钥信息 |
| CVE-2026-97873 | 5.3 MEDIUM | JCA原始提供程序未限制PBES1和PKCS#12迭代次数 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-71888
暂无评论