Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-28052

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

Published

2020-12-18T01:15:12.587

Last Modified

2025-05-12T17:37:16.527

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application bouncycastle bc-java 1.65 Yes
Application bouncycastle bc-java 1.66 Yes
Application apache karaf 4.3.2 Yes
Application oracle banking_corporate_lending_process_management 14.2.0 Yes
Application oracle banking_corporate_lending_process_management 14.3.0 Yes
Application oracle banking_corporate_lending_process_management 14.5.0 Yes
Application oracle banking_credit_facilities_process_management 14.2.0 Yes
Application oracle banking_credit_facilities_process_management 14.3.0 Yes
Application oracle banking_credit_facilities_process_management 14.5.0 Yes
Application oracle banking_extensibility_workbench 14.2.0 Yes
Application oracle banking_extensibility_workbench 14.3.0 Yes
Application oracle banking_extensibility_workbench 14.5.0 Yes
Application oracle banking_supply_chain_finance 14.2.0 Yes
Application oracle banking_supply_chain_finance 14.3.0 Yes
Application oracle banking_supply_chain_finance 14.5.0 Yes
Application oracle banking_virtual_account_management 14.2.0 Yes
Application oracle banking_virtual_account_management 14.3.0 Yes
Application oracle banking_virtual_account_management 14.5.0 Yes
Application oracle blockchain_platform < 21.1.2 Yes
Application oracle commerce_guided_search 11.3.2 Yes
Application oracle communications_application_session_controller 3.9m0p3 Yes
Application oracle communications_cloud_native_core_network_slice_selection_function 1.2.1 Yes
Application oracle communications_convergence 3.0.2.2.0 Yes
Application oracle communications_pricing_design_center 12.0.0.3.0 Yes
Application oracle communications_session_report_manager ≤ 8.2.4.0 Yes
Application oracle communications_session_route_manager ≤ 8.2.4 Yes
Application oracle jd_edwards_enterpriseone_tools ≤ 9.2.5.3 Yes
Application oracle peoplesoft_enterprise_peopletools 8.56 Yes
Application oracle peoplesoft_enterprise_peopletools 8.57 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle utilities_framework 4.3.0.6.0 Yes
Application oracle utilities_framework 4.4.0.0.0 Yes
Application oracle utilities_framework 4.4.0.2.0 Yes
Application oracle utilities_framework 4.4.0.3.0 Yes
Application oracle webcenter_portal 11.1.1.9.0 Yes
Application oracle webcenter_portal 12.2.1.3.0 Yes
Application oracle webcenter_portal 12.2.1.4.0 Yes
Operating System oracle communications_messaging_server 8.0.2 Yes
Operating System oracle communications_messaging_server 8.1 Yes
References