Strix
26.1K

CVE-2020-28052

HIGHCVSS 8.1/10EPSS 7.14%

Last modified

CVE-2020-28052 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.. EPSS estimates a 7.14% chance of exploitation in the next 30 days.

Description

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
7.14%

93.5th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
BouncycastleBc-Java1.65
BouncycastleBc-Java1.66
ApacheKaraf4.3.2
OracleBanking Corporate Lending Process Management14.2.0
OracleBanking Corporate Lending Process Management14.3.0
OracleBanking Corporate Lending Process Management14.5.0
OracleBanking Credit Facilities Process Management14.2.0
OracleBanking Credit Facilities Process Management14.3.0
OracleBanking Credit Facilities Process Management14.5.0
OracleBanking Extensibility Workbench14.2.0
OracleBanking Extensibility Workbench14.3.0
OracleBanking Extensibility Workbench14.5.0
OracleBanking Supply Chain Finance14.2.0
OracleBanking Supply Chain Finance14.3.0
OracleBanking Supply Chain Finance14.5.0
OracleBanking Virtual Account Management14.2.0
OracleBanking Virtual Account Management14.3.0
OracleBanking Virtual Account Management14.5.0
OracleBlockchain Platform< 21.1.2
OracleCommerce Guided Search11.3.2
OracleCommunications Application Session Controller3.9m0p3
OracleCommunications Cloud Native Core Network Slice Selection Function1.2.1
OracleCommunications Convergence3.0.2.2.0
OracleCommunications Pricing Design Center12.0.0.3.0
OracleCommunications Session Report Manager>= 8.0.0, <= 8.2.4.0
OracleCommunications Session Route Manager>= 8.2.0, <= 8.2.4
OracleJd Edwards Enterpriseone Tools<= 9.2.5.3
OraclePeoplesoft Enterprise Peopletools8.56
OraclePeoplesoft Enterprise Peopletools8.57
OraclePeoplesoft Enterprise Peopletools8.58
OracleUtilities Framework4.3.0.6.0
OracleUtilities Framework4.4.0.0.0
OracleUtilities Framework4.4.0.2.0
OracleUtilities Framework4.4.0.3.0
OracleWebcenter Portal11.1.1.9.0
OracleWebcenter Portal12.2.1.3.0
OracleWebcenter Portal12.2.1.4.0
OracleCommunications Messaging Server8.0.2
OracleCommunications Messaging Server8.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-28052?
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
How severe is CVE-2020-28052?
CVE-2020-28052 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 7.14% probability of exploitation in the next 30 days.
How do I fix CVE-2020-28052?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-28052?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST