CVE-2020-28052: Logic error in Legion of the Bouncy Castle BC Java
Summary
CVE-2020-28052: Logic error in Legion of the Bouncy Castle BC Java. Affects org.bouncycastle:bcprov-jdk15to18 versions >= 1.65, < 1.67. Fixed in 1.67. How to fix ↓
Also tracked for
- bouncycastle · Debian:11
The same CVE-2020-28052 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Legion of the Bouncy Castle BC Java is an open-source cryptographic library that provides a wide range of cryptographic algorithms and protocols. It is commonly used in Java applications for secure communication, encryption, and digital signatures. The library is widely adopted and trusted by developers for its robustness and extensive features. However, a logic error has been discovered in versions 1.65 and 1.66 of the library, which could lead to incorrect password verification.
Vulnerability Detail
The vulnerability, identified as CVE-2020-28052, stems from a logic error in the OpenBSDBCrypt.checkPassword utility method of the Legion of the Bouncy Castle BC Java library. This error causes incorrect data comparison during password verification, allowing incorrect passwords to be falsely recognized as matching with previously hashed ones that are different. As a result, an attacker could potentially bypass password authentication and gain unauthorized access to systems or sensitive information. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
How To Fix
Minimum fixed version
1.67
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a patched version of the Legion of the Bouncy Castle BC Java library.
Conclusion
The Legion of the Bouncy Castle BC Java library versions 1.65 and 1.66 are affected by a logic error that could allow incorrect passwords to be falsely recognized as matching. This vulnerability has a high severity rating and could potentially lead to unauthorized access to systems or sensitive information. It is crucial for developers to upgrade to version 1.67 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.bouncycastle:bcprov-jdk15to18 →
FAQ
The Legion of the Bouncy Castle BC Java library is an open-source cryptographic library that provides various cryptographic algorithms and protocols for Java applications.
This vulnerability allows incorrect passwords to be falsely recognized as matching with previously hashed ones, potentially enabling unauthorized access to systems or sensitive information.
The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a patched version of the library.
To fix this vulnerability, it is recommended to upgrade the affected library to version 1.67 or later. Developers should update their Maven dependencies to include the fixed version of the library.
Related vulnerabilities
Recent vulnerabilities recorded for org.bouncycastle:bcprov-jdk15to18.
