GHSA-73xv-w5gp-frxh CVE-2020-28052
Logic error in Legion of the Bouncy Castle BC Java
High
Maven
- Severity
- 8.1 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 7.22%
- Chance of exploitation in the next 30 days. Higher than 94.32% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-670 Always-Incorrect Control Flow Implementation
- Fix
- Available
- 7 packages have a fixed version
Description
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.bouncycastle:bcprov-ext-jdk15on | >= 1.65, < 1.67 |
1.67 |
| org.bouncycastle:bcprov-ext-jdk16 | >= 1.65, < 1.67 |
1.67 |
| org.bouncycastle:bcprov-jdk14 | >= 1.65, < 1.67 |
1.67 |
| org.bouncycastle:bcprov-jdk15 | >= 1.65, < 1.67 |
1.67 |
| org.bouncycastle:bcprov-jdk15on | >= 1.65, < 1.67 |
1.67 |
| org.bouncycastle:bcprov-jdk15to18 | >= 1.65, < 1.67 |
1.67 |
| org.bouncycastle:bcprov-jdk16 | >= 1.65, < 1.67 |
1.67 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.bouncycastle:bcprov-ext-jdk15on Maven → 1.67
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-ext-jdk15on</artifactId><version>1.67</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-ext-jdk15on:1.67")
org.bouncycastle:bcprov-ext-jdk16 Maven → 1.67
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-ext-jdk16</artifactId><version>1.67</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-ext-jdk16:1.67")
org.bouncycastle:bcprov-jdk14 Maven → 1.67
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk14</artifactId><version>1.67</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk14:1.67")
org.bouncycastle:bcprov-jdk15 Maven → 1.67
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk15</artifactId><version>1.67</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk15:1.67")
org.bouncycastle:bcprov-jdk15on Maven → 1.67
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk15on</artifactId><version>1.67</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk15on:1.67")
org.bouncycastle:bcprov-jdk15to18 Maven → 1.67
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk15to18</artifactId><version>1.67</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk15to18:1.67")
org.bouncycastle:bcprov-jdk16 Maven → 1.67
- maven
<dependency><groupId>org.bouncycastle</groupId><artifactId>bcprov-jdk16</artifactId><version>1.67</version></dependency>- gradle
implementation("org.bouncycastle:bcprov-jdk16:1.67")
Severity breakdown
CVSS 3.1 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-670: Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
References
Advisories
Packages
Other links
- github.com/bcgit/bc-java/commit/97578f9b7ed277e6ecb58834e85e3d18385a4219
- synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle
- oracle.com/security-alerts/cpuoct2021.html
- oracle.com/security-alerts/cpujul2022.html
- oracle.com/security-alerts/cpujan2022.html
- oracle.com/security-alerts/cpuapr2022.html
- oracle.com/security-alerts/cpuApr2021.html
- oracle.com//security-alerts/cpujul2021.html
- bouncycastle.org/releasenotes.html
- lists.apache.org/thread.html/rfc0db1f3c375087e69a239f9284ded72d04fbb55849eadde58fa9dc…
- lists.apache.org/thread.html/rf9abfc0223747a56694825c050cc6b66627a293a32ea926b3de2240…
- lists.apache.org/thread.html/rdfd2901b8b697a3f6e2c9c6ecc688fd90d7f881937affb5144d61d6…
- lists.apache.org/thread.html/rddd2237b8636a48d573869006ee809262525efb2b6ffa6eff50d2a2…
- lists.apache.org/thread.html/rdcbad6d8ce72c79827ed8c635f9a62dd919bb21c94a0b64cab2efc3…
- lists.apache.org/thread.html/rcd37d9214b08067a2e8f2b5b4fd123a1f8cb6008698d11ef44028c2…
- lists.apache.org/thread.html/rc9e441c1576bdc4375d32526d5cf457226928e9c87b9f54ded26271…
- lists.apache.org/thread.html/r954d80fd18e9dafef6e813963eb7e08c228151c2b6268ecd63b35d1…
- lists.apache.org/thread.html/r8c36ba34e80e05eecb1f80071cc834d705616f315b634ec0c7d8f42…
- lists.apache.org/thread.html/r77af3ac7c3bfbd5454546e13faf7aec21d627bdcf36c9ca240436b9…
- lists.apache.org/thread.html/r4e1619cfefcd031fac62064a3858f5c9229eef907bd5d8ef14c594f…
- lists.apache.org/thread.html/r37d332c0bf772f4982d1fdeeb2f88dd71dab6451213e69e43734ead…
- lists.apache.org/thread.html/r30a139c165b3da6e0d5536434ab1550534011b1fdfcd2f5d95892c5…
- lists.apache.org/thread.html/r2ddabd06d94b60cfb0141e4abb23201c628ab925e30742f61a04d01…
- lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4…
- lists.apache.org/thread.html/r175f5a25d100dbe2b1bd3459b3ce882a84c3ff91b120ed4ff2d57b5…
- lists.apache.org/thread.html/r167dbc42ef7c59802c2ca1ac14735ef9cf687c25208229993d6206f…
- github.com/bcgit/bc-java/wiki/CVE-2020-28052
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-p93r-85wp-75v3 Bouncy Castle Has Covert Timing Channel Vulnerability | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-c3fc-8qff-9hwx Bouncy Castle has an LDAP injection | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-574f-3g2m-x479 Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-67mf-3cr5-8w23 Bouncy Castle for Java on All (API modules) allows Excessive Allocation | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-m44j-cfrm-g8qc Bouncy Castle crafted signature and public key can be used to trigger an infinite loop | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-v435-xc8x-wvr9 Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") | Medium | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-8xfc-gm6g-vgpv Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. | High | Also affects org.bouncycastle:bcprov-jdk14 |
| GHSA-4h8f-2wvx-gg5w Bouncy Castle Java Cryptography API vulnerable to DNS poisoning | High | Also affects org.bouncycastle:bcprov-jdk14 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor