CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-28052
High (8.1). EPSS 7.2% chance of exploitation in the next 30 days. Fixed in org.bouncycastle:bcprov-jdk15to18 1.67.
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Severity
- EPSS
- 7.2% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:karaf
- bouncycastle:bc-java
- oracle:banking_corporate_lending_process_management
- oracle:banking_credit_facilities_process_management
- oracle:banking_extensibility_workbench
- oracle:banking_supply_chain_finance
- oracle:banking_virtual_account_management
- oracle:blockchain_platform
- oracle:commerce_guided_search
- oracle:communications_application_session_controller
- oracle:communications_cloud_native_core_network_slice_selection_function
- oracle:communications_convergence
- oracle:communications_messaging_server
- oracle:communications_pricing_design_center
- oracle:communications_session_report_manager
- oracle:communications_session_route_manager
- oracle:jd_edwards_enterpriseone_tools
- oracle:peoplesoft_enterprise_peopletools
- oracle:utilities_framework
- oracle:webcenter_portal
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-73xv-w5gp-frxh | Maven | org.bouncycastle:bcprov-jdk15to18 | >=1.65 <1.67 | 1.67 |
| GHSA-73xv-w5gp-frxh | Maven | org.bouncycastle:bcprov-jdk15 | >=1.65 <1.67 | 1.67 |
| GHSA-73xv-w5gp-frxh | Maven | org.bouncycastle:bcprov-jdk15on | >=1.65 <1.67 | 1.67 |
| GHSA-73xv-w5gp-frxh | Maven | org.bouncycastle:bcprov-ext-jdk15on | >=1.65 <1.67 | 1.67 |
| GHSA-73xv-w5gp-frxh | Maven | org.bouncycastle:bcprov-jdk14 | >=1.65 <1.67 | 1.67 |
| GHSA-73xv-w5gp-frxh | Maven | org.bouncycastle:bcprov-jdk16 | >=1.65 <1.67 | 1.67 |
| GHSA-73xv-w5gp-frxh | Maven | org.bouncycastle:bcprov-ext-jdk16 | >=1.65 <1.67 | 1.67 |
References
- https://github.com/bcgit/bc-java/wiki/CVE-2020-28052
- https://lists.apache.org/thread.html/r167dbc42ef7c59802c2ca1ac14735ef9cf687c25208229993d6206fe%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r175f5a25d100dbe2b1bd3459b3ce882a84c3ff91b120ed4ff2d57b53%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4a%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r2ddabd06d94b60cfb0141e4abb23201c628ab925e30742f61a04d013%40%3Cissues.karaf.apache.org%3E