CVE-2020-28052: High severity bouncycastle Legion-of-the-bouncy-castle-java-crytography-api vulnerability

Published Dec 18, 2020
·
Updated

A flaw was found in bouncycastle. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Other sources

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

Affected Software

90 affected componentsFixes available
redhat/eap7-activemq-artemis<0:2.9.0-9.redhat_00019.1.el6ea
0:2.9.0-9.redhat_00019.1.el6ea
redhat/eap7-bouncycastle<0:1.68.0-1.redhat_00001.1.el6ea
0:1.68.0-1.redhat_00001.1.el6ea
redhat/eap7-guava-failureaccess<0:1.0.1-1.redhat_00002.1.el6ea
0:1.0.1-1.redhat_00002.1.el6ea
redhat/eap7-guava-libraries<0:30.1.0-1.redhat_00001.1.el6ea
0:30.1.0-1.redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.13-1.Final_redhat_00001.1.el6ea
0:3.2.13-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.27-1.Final_redhat_00001.1.el6ea
0:1.4.27-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.39-1.SP1_redhat_00001.1.el6ea
0:4.0.39-1.SP1_redhat_00001.1.el6ea
redhat/eap7-jboss-logmanager<0:2.1.18-1.Final_redhat_00001.1.el6ea
0:2.1.18-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-remoting<0:5.0.20-2.SP1_redhat_00001.1.el6ea
0:5.0.20-2.SP1_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-5.Final_redhat_00006.1.el6ea
0:1.7.2-5.Final_redhat_00006.1.el6ea
redhat/eap7-narayana<0:5.9.11-1.Final_redhat_00001.1.el6ea
0:5.9.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.34-1.SP1_redhat_00001.1.el6ea
0:2.0.34-1.SP1_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.3.6-1.GA_redhat_00002.1.el6ea
0:7.3.6-1.GA_redhat_00002.1.el6ea
redhat/eap7-wildfly-elytron<0:1.10.11-1.Final_redhat_00001.1.el6ea
0:1.10.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-http-client<0:1.0.25-1.Final_redhat_00001.1.el6ea
0:1.0.25-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-naming-client<0:1.0.14-1.Final_redhat_00001.1.el6ea
0:1.0.14-1.Final_redhat_00001.1.el6ea
redhat/eap7-activemq-artemis<0:2.9.0-9.redhat_00019.1.el7ea
0:2.9.0-9.redhat_00019.1.el7ea
redhat/eap7-bouncycastle<0:1.68.0-1.redhat_00001.1.el7ea
0:1.68.0-1.redhat_00001.1.el7ea
redhat/eap7-guava-failureaccess<0:1.0.1-1.redhat_00002.1.el7ea
0:1.0.1-1.redhat_00002.1.el7ea
redhat/eap7-guava-libraries<0:30.1.0-1.redhat_00001.1.el7ea
0:30.1.0-1.redhat_00001.1.el7ea
redhat/eap7-hal-console<0:3.2.13-1.Final_redhat_00001.1.el7ea
0:3.2.13-1.Final_redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.4.27-1.Final_redhat_00001.1.el7ea
0:1.4.27-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-ejb-client<0:4.0.39-1.SP1_redhat_00001.1.el7ea
0:4.0.39-1.SP1_redhat_00001.1.el7ea
redhat/eap7-jboss-logmanager<0:2.1.18-1.Final_redhat_00001.1.el7ea
0:2.1.18-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-remoting<0:5.0.20-2.SP1_redhat_00001.1.el7ea
0:5.0.20-2.SP1_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.7.2-5.Final_redhat_00006.1.el7ea
0:1.7.2-5.Final_redhat_00006.1.el7ea
redhat/eap7-narayana<0:5.9.11-1.Final_redhat_00001.1.el7ea
0:5.9.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.34-1.SP1_redhat_00001.1.el7ea
0:2.0.34-1.SP1_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.3.6-1.GA_redhat_00002.1.el7ea
0:7.3.6-1.GA_redhat_00002.1.el7ea
redhat/eap7-wildfly-elytron<0:1.10.11-1.Final_redhat_00001.1.el7ea
0:1.10.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-http-client<0:1.0.25-1.Final_redhat_00001.1.el7ea
0:1.0.25-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-naming-client<0:1.0.14-1.Final_redhat_00001.1.el7ea
0:1.0.14-1.Final_redhat_00001.1.el7ea
redhat/eap7-activemq-artemis<0:2.9.0-9.redhat_00019.1.el8ea
0:2.9.0-9.redhat_00019.1.el8ea
redhat/eap7-bouncycastle<0:1.68.0-1.redhat_00001.1.el8ea
0:1.68.0-1.redhat_00001.1.el8ea
redhat/eap7-guava-failureaccess<0:1.0.1-1.redhat_00002.1.el8ea
0:1.0.1-1.redhat_00002.1.el8ea
redhat/eap7-guava-libraries<0:30.1.0-1.redhat_00001.1.el8ea
0:30.1.0-1.redhat_00001.1.el8ea
redhat/eap7-hal-console<0:3.2.13-1.Final_redhat_00001.1.el8ea
0:3.2.13-1.Final_redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.4.27-1.Final_redhat_00001.1.el8ea
0:1.4.27-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-ejb-client<0:4.0.39-1.SP1_redhat_00001.1.el8ea
0:4.0.39-1.SP1_redhat_00001.1.el8ea
redhat/eap7-jboss-logmanager<0:2.1.18-1.Final_redhat_00001.1.el8ea
0:2.1.18-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-remoting<0:5.0.20-2.SP1_redhat_00001.1.el8ea
0:5.0.20-2.SP1_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.7.2-5.Final_redhat_00006.1.el8ea
0:1.7.2-5.Final_redhat_00006.1.el8ea
redhat/eap7-narayana<0:5.9.11-1.Final_redhat_00001.1.el8ea
0:5.9.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.0.34-1.SP1_redhat_00001.1.el8ea
0:2.0.34-1.SP1_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.3.6-1.GA_redhat_00002.1.el8ea
0:7.3.6-1.GA_redhat_00002.1.el8ea
redhat/eap7-wildfly-elytron<0:1.10.11-1.Final_redhat_00001.1.el8ea
0:1.10.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-http-client<0:1.0.25-1.Final_redhat_00001.1.el8ea
0:1.0.25-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-naming-client<0:1.0.14-1.Final_redhat_00001.1.el8ea
0:1.0.14-1.Final_redhat_00001.1.el8ea
redhat/bouncycastle<1.67
1.67
bouncycastle Legion-of-the-bouncy-castle-java-crytography-api=1.65
bouncycastle Legion-of-the-bouncy-castle-java-crytography-api=1.66
Apache Karaf=4.3.2
Oracle Banking Corporate Lending Process Management=14.2.0
Oracle Banking Corporate Lending Process Management=14.3.0
Oracle Banking Corporate Lending Process Management=14.5.0
Oracle Banking Credit Facilities Process Management=14.2.0
Oracle Banking Credit Facilities Process Management=14.3.0
Oracle Banking Credit Facilities Process Management=14.5.0
Oracle Banking Extensibility Workbench=14.2.0
Oracle Banking Extensibility Workbench=14.3.0
Oracle Banking Extensibility Workbench=14.5.0
Oracle Banking Supply Chain Finance=14.2.0
Oracle Banking Supply Chain Finance=14.3.0
Oracle Banking Supply Chain Finance=14.5.0
Oracle Banking Virtual Account Management=14.2.0
Oracle Banking Virtual Account Management=14.3.0
Oracle Banking Virtual Account Management=14.5.0
Oracle Blockchain Platform<21.1.2
Oracle Commerce Guided Search=11.3.2
Oracle Communications Application Session Controller=3.9m0p3
Oracle Communications Cloud Native Core Network Slice Selection Function=1.2.1
Oracle Communications Convergence=3.0.2.2.0
Oracle Communications Pricing Design Center=12.0.0.3.0
Oracle Communications Session Report Manager>=8.0.0<=8.2.4.0
Oracle Communications Session Route Manager>=8.2.0<=8.2.4
ORACLE JD Edwards EnterpriseOne Tools<=9.2.5.3
Oracle PeopleSoft Enterprise PeopleTools=8.56
Oracle PeopleSoft Enterprise PeopleTools=8.57
Oracle PeopleSoft Enterprise PeopleTools=8.58
Oracle Utilities Framework=4.3.0.6.0
Oracle Utilities Framework=4.4.0.0.0
Oracle Utilities Framework=4.4.0.2.0
Oracle Utilities Framework=4.4.0.3.0
Oracle WebCenter Portal=11.1.1.9.0
Oracle WebCenter Portal=12.2.1.3.0
Oracle WebCenter Portal=12.2.1.4.0
ORACLE Communications Messaging Server=8.0.2
ORACLE Communications Messaging Server=8.1
bouncycastle bc-java=1.65
bouncycastle bc-java=1.66

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/eap7-activemq-artemis to a version that resolves this vulnerability.

    Fixed in 0:2.9.0-9.redhat_00019.1.el6ea
  2. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-1.redhat_00001.1.el6ea
  3. Upgrade

    Upgrade redhat/eap7-guava-failureaccess to a version that resolves this vulnerability.

    Fixed in 0:1.0.1-1.redhat_00002.1.el6ea
  4. Upgrade

    Upgrade redhat/eap7-guava-libraries to a version that resolves this vulnerability.

    Fixed in 0:30.1.0-1.redhat_00001.1.el6ea
  5. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.13-1.Final_redhat_00001.1.el6ea
  6. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.27-1.Final_redhat_00001.1.el6ea
  7. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.39-1.SP1_redhat_00001.1.el6ea
  8. Upgrade

    Upgrade redhat/eap7-jboss-logmanager to a version that resolves this vulnerability.

    Fixed in 0:2.1.18-1.Final_redhat_00001.1.el6ea
  9. Upgrade

    Upgrade redhat/eap7-jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:5.0.20-2.SP1_redhat_00001.1.el6ea
  10. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-5.Final_redhat_00006.1.el6ea
  11. Upgrade

    Upgrade redhat/eap7-narayana to a version that resolves this vulnerability.

    Fixed in 0:5.9.11-1.Final_redhat_00001.1.el6ea
  12. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.34-1.SP1_redhat_00001.1.el6ea
  13. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.6-1.GA_redhat_00002.1.el6ea
  14. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.11-1.Final_redhat_00001.1.el6ea
  15. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.25-1.Final_redhat_00001.1.el6ea
  16. Upgrade

    Upgrade redhat/eap7-wildfly-naming-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.14-1.Final_redhat_00001.1.el6ea
  17. Upgrade

    Upgrade redhat/eap7-activemq-artemis to a version that resolves this vulnerability.

    Fixed in 0:2.9.0-9.redhat_00019.1.el7ea
  18. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-1.redhat_00001.1.el7ea
  19. Upgrade

    Upgrade redhat/eap7-guava-failureaccess to a version that resolves this vulnerability.

    Fixed in 0:1.0.1-1.redhat_00002.1.el7ea
  20. Upgrade

    Upgrade redhat/eap7-guava-libraries to a version that resolves this vulnerability.

    Fixed in 0:30.1.0-1.redhat_00001.1.el7ea
  21. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.13-1.Final_redhat_00001.1.el7ea
  22. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.27-1.Final_redhat_00001.1.el7ea
  23. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.39-1.SP1_redhat_00001.1.el7ea
  24. Upgrade

    Upgrade redhat/eap7-jboss-logmanager to a version that resolves this vulnerability.

    Fixed in 0:2.1.18-1.Final_redhat_00001.1.el7ea
  25. Upgrade

    Upgrade redhat/eap7-jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:5.0.20-2.SP1_redhat_00001.1.el7ea
  26. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-5.Final_redhat_00006.1.el7ea
  27. Upgrade

    Upgrade redhat/eap7-narayana to a version that resolves this vulnerability.

    Fixed in 0:5.9.11-1.Final_redhat_00001.1.el7ea
  28. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.34-1.SP1_redhat_00001.1.el7ea
  29. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.6-1.GA_redhat_00002.1.el7ea
  30. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.11-1.Final_redhat_00001.1.el7ea
  31. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.25-1.Final_redhat_00001.1.el7ea
  32. Upgrade

    Upgrade redhat/eap7-wildfly-naming-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.14-1.Final_redhat_00001.1.el7ea
  33. Upgrade

    Upgrade redhat/eap7-activemq-artemis to a version that resolves this vulnerability.

    Fixed in 0:2.9.0-9.redhat_00019.1.el8ea
  34. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-1.redhat_00001.1.el8ea
  35. Upgrade

    Upgrade redhat/eap7-guava-failureaccess to a version that resolves this vulnerability.

    Fixed in 0:1.0.1-1.redhat_00002.1.el8ea
  36. Upgrade

    Upgrade redhat/eap7-guava-libraries to a version that resolves this vulnerability.

    Fixed in 0:30.1.0-1.redhat_00001.1.el8ea
  37. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.13-1.Final_redhat_00001.1.el8ea
  38. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.27-1.Final_redhat_00001.1.el8ea
  39. Upgrade

    Upgrade redhat/eap7-jboss-ejb-client to a version that resolves this vulnerability.

    Fixed in 0:4.0.39-1.SP1_redhat_00001.1.el8ea
  40. Upgrade

    Upgrade redhat/eap7-jboss-logmanager to a version that resolves this vulnerability.

    Fixed in 0:2.1.18-1.Final_redhat_00001.1.el8ea
  41. Upgrade

    Upgrade redhat/eap7-jboss-remoting to a version that resolves this vulnerability.

    Fixed in 0:5.0.20-2.SP1_redhat_00001.1.el8ea
  42. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-5.Final_redhat_00006.1.el8ea
  43. Upgrade

    Upgrade redhat/eap7-narayana to a version that resolves this vulnerability.

    Fixed in 0:5.9.11-1.Final_redhat_00001.1.el8ea
  44. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.34-1.SP1_redhat_00001.1.el8ea
  45. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.6-1.GA_redhat_00002.1.el8ea
  46. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.11-1.Final_redhat_00001.1.el8ea
  47. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.25-1.Final_redhat_00001.1.el8ea
  48. Upgrade

    Upgrade redhat/eap7-wildfly-naming-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.14-1.Final_redhat_00001.1.el8ea
  49. Upgrade

    Upgrade redhat/bouncycastle to a version that resolves this vulnerability.

    Fixed in 1.67
  50. Compensating control

    If you cannot upgrade Bouncy Castle to 1.67 or later, as a workaround copy the OpenBSDBCrypt.doCheckPassword() method implementation into your own utility class and supplement it with the required helper methods and variables to replace the vulnerable check.

Event History

Dec 18, 2020
CVE Published
12:00 AM
CVE Published
via MITRE·12:52 AM
Data Sourced
via MITRE·12:52 AM
Description
Jan 5, 2021
Data Sourced
via Red Hat·01:58 PM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2020-28052?

CVE-2020-28052 has a high severity rating due to its potential impact on password security.

2

How do I fix CVE-2020-28052?

To fix CVE-2020-28052, update your Bouncy Castle library to version 1.67 or later.

3

What software is affected by CVE-2020-28052?

CVE-2020-28052 affects various packages including eap7-bouncycastle, eap7-activemq-artemis, and others from Red Hat.

4

What is the nature of the vulnerability in CVE-2020-28052?

The vulnerability in CVE-2020-28052 involves incorrect data comparison in password checks, leading to potential authentication bypass.

5

Is CVE-2020-28052 still a risk if my software is updated?

If your software is updated to the recommended versions, the risk associated with CVE-2020-28052 is mitigated.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203