GitHub Advisoryadvisory · Maven

GHSA-73xv-w5gp-frxh Logic error in Legion of the Bouncy Castle BC Java

HIGH Published 2021-04-30 Modified 2022-02-08 Official page ↗
Aliases
CVE-2020-28052
Ecosystem
Maven
Packages
org.bouncycastle:bcprov-jdk15to18, org.bouncycastle:bcprov-jdk15, org.bouncycastle:bcprov-jdk15on, org.bouncycastle:bcprov-ext-jdk15on, org.bouncycastle:bcprov-jdk14, org.bouncycastle:bcprov-jdk16, org.bouncycastle:bcprov-ext-jdk16
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-670
Reviewed
2021-03-19

Affected packages

• Maven org.bouncycastle:bcprov-jdk15to18: >= 1.65, < 1.67 → fixed in 1.67 • Maven org.bouncycastle:bcprov-jdk15: >= 1.65, < 1.67 → fixed in 1.67 • Maven org.bouncycastle:bcprov-jdk15on: >= 1.65, < 1.67 → fixed in 1.67 • Maven org.bouncycastle:bcprov-ext-jdk15on: >= 1.65, < 1.67 → fixed in 1.67 • Maven org.bouncycastle:bcprov-jdk14: >= 1.65, < 1.67 → fixed in 1.67 • Maven org.bouncycastle:bcprov-jdk16: >= 1.65, < 1.67 → fixed in 1.67 • Maven org.bouncycastle:bcprov-ext-jdk16: >= 1.65, < 1.67 → fixed in 1.67

Description

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

Related

Alias · CVE (1)

  • CVE-2020-28052 An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. vulnerability

Weakness · CWE (1)

  • CWE-670 Always-Incorrect Control Flow Implementation weakness

References