GitHub Advisoryadvisory · Maven

GHSA-9h6p-92jq-888x Integer Overflow or Wraparound in JBCrypt

MEDIUM Published 2022-05-13 Modified 2022-07-06 Official page ↗
Aliases
CVE-2015-0886
Ecosystem
Maven
Packages
org.mindrot:jbcrypt
Severity
Moderate
Weaknesses
CWE-190
Reviewed
2022-07-06

Affected packages

• Maven org.mindrot:jbcrypt: < 0.4 → fixed in 0.4

Description

Integer overflow in the crypt_raw method in the key-stretching implementation in JBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.

Related

Alias · CVE (1)

  • CVE-2015-0886 Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References