VDB
CVE-2020-28052
CVE-2020-28052
REJECTED
CVSS 8.100000381469727 HIGH
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
EPSS 7.23% · 94.2th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
7.23%
94.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:22.04:LTS | bouncycastle | 1.68-5, 0, 1.68-2 |
| Ubuntu:20.04:LTS | bouncycastle | 1.61-1, 0 |
| Ubuntu:16.04:LTS | bouncycastle | 1.49+dfsg-3ubuntu1, 1.51-4ubuntu1, 0 |
| Ubuntu:24.04:LTS | bouncycastle | 1.77-1, 0, 1.72-2 |
| Ubuntu:25.10 | bouncycastle | 0, 1.77-1, 1.80-3 |
| Ubuntu:18.04:LTS | bouncycastle | 1.59-1, 1.58-1, 1.57-1 |
Timeline
- Dec 18, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- May 29, 2021 EPSS Score
- Aug 10, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Mar 1, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Nov 8, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-28052 advisory
- https://github.com/bcgit/bc-java/wiki/CVE-2020-28052 third-party-advisory
- https://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle/ third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-28052 third-party-advisory