Bugzilla – Bug 1180215
VUL-0: CVE-2020-28052: bouncycastle: OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password
Last modified: 2022-06-28 12:35:23 UTC
CVE-2020-28052 An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different. ouch, bad one References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28052 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28052 https://github.com/bcgit/bc-java/wiki/CVE-2020-28052 https://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle/ https://www.bouncycastle.org/releasenotes.html
Only versions BC 1.65 or BC 1.66 affected, see: https://github.com/bcgit/bc-java/wiki/CVE-2020-28052 Updated to version BC 1.67 in Factory: https://build.opensuse.org/request/show/857837 https://www.bouncycastle.org/releasenotes.html No SLE code is affected.
thank you