CVE-2015-0886: Integer Overflow or Wraparound in JBCrypt
Summary
CVE-2015-0886: Integer Overflow or Wraparound in JBCrypt. Affects org.mindrot:jbcrypt versions < 0.4. Fixed in 0.4. How to fix ↓
Also tracked for
- libjbcrypt-java · Debian:11
The same CVE-2015-0886 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
JBCrypt is a key-stretching implementation library that provides password hashing functionality. It is commonly used in applications to securely store and verify user passwords. This vulnerability (CVE-2015-0886) affects versions prior to 0.4 of the JBCrypt library. The vulnerability arises from an integer overflow in the crypt_raw method, which can make it easier for remote attackers to determine cleartext values of password hashes through a brute-force attack against hashes associated with the maximum exponent.
Vulnerability Detail
The vulnerability in JBCrypt allows attackers to exploit an integer overflow or wraparound issue in the crypt_raw method. By manipulating the maximum exponent and performing a brute-force attack on the password hashes, an attacker can potentially determine the original cleartext values of the password hashes. This can lead to unauthorized access to user accounts and compromise the security of the application. The vulnerability has a moderate severity rating and is classified under CWE-190.
How To Fix
Minimum fixed version
0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the JBCrypt library.
Conclusion
The CVE-2015-0886 vulnerability in JBCrypt exposes a potential risk of password hash compromise. It is crucial for developers to upgrade to the fixed version of the JBCrypt library (0.4 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.mindrot:jbcrypt →
FAQ
JBCrypt is a key-stretching implementation library used for password hashing in applications.
This vulnerability can allow attackers to determine the original cleartext values of password hashes, potentially leading to unauthorized access to user accounts.
To fix this vulnerability, upgrade to version 0.4 or later of the JBCrypt library.
No specific workaround is mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
This vulnerability has a moderate severity rating.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
