Password Validation Flaw in Bouncy Castle Java: CVE-2020-28052
Summary
CVE-2020-28052: An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. Affects bouncycastle versions < 1.65-2. Fixed in 1.65-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bouncy Castle is a widely used cryptography library in Java that provides a range of cryptographic functions and algorithms. It is integral for developers needing secure data transmission and storage. The library is known for its flexibility and extensive support for various cryptographic standards. However, a vulnerability was discovered in versions 1.65 and 1.66, which affects the password validation mechanism, potentially compromising security.
Vulnerability Detail
The vulnerability, identified as CVE-2020-28052, arises from the OpenBSDBCrypt.checkPassword utility method in Bouncy Castle. This method incorrectly compares data when validating passwords, allowing attackers to exploit this flaw. As a result, incorrect passwords may be incorrectly validated as correct, leading to unauthorized access. This vulnerability is particularly concerning as it can allow attackers to bypass authentication mechanisms, posing significant security risks to applications relying on this library.
How To Fix
Minimum fixed version
1.65-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bouncycastleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional checks in their authentication logic to ensure that password validation is performed securely. However, this is not a substitute for upgrading the library. It is recommended to avoid using the affected versions until an upgrade can be performed.
Conclusion
CVE-2020-28052 represents a significant security risk for applications using the Bouncy Castle Java library. It is crucial for developers to upgrade to the patched version to ensure the integrity of their authentication processes. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for bouncycastle →
FAQ
CVE-2020-28052 is a vulnerability in the Bouncy Castle Java library that allows incorrect passwords to be validated as correct due to improper data comparison in the password checking method.
The affected versions are 1.65 and 1.66. Users should upgrade to version 1.65-2 or later to mitigate the vulnerability.
Exploitation of this vulnerability could allow unauthorized users to gain access to systems by bypassing authentication, leading to data breaches and other security incidents.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
The CVSS score for CVE-2020-28052 is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for bouncycastle.
