CVE-2020-28052

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

Summary:

Reference Links(if available):

https://github.com/bcgit/bc-java/wiki/CVE-2020-28052

https://www.bouncycastle.org/releasenotes.html

https://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle/

https://lists.apache.org/thread.html/r954d80fd18e9dafef6e813963eb7e08c228151c2b6268ecd63b35d1f@%3Ccommits.druid.apache.org%3E

https://lists.apache.org/thread.html/rddd2237b8636a48d573869006ee809262525efb2b6ffa6eff50d2a2d@%3Cjira.kafka.apache.org%3E

CVSS Score (if available)

v2: / MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

v3: / HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2020-28052

Summary:

Reference Links(if available):

CVSS Score (if available)

Links to Exploits(if available)

Ransomware Groups Exploit Cloud Services for Data Exfiltration and Attacks

Zero-Day Vulnerability Discovered by watchTowr in Fortinet Products

O2’s Innovative AI Granny Tackles Scam Callers with Engaging Tales

Palo Alto Networks Zero-Day Vulnerability Actively Exploited: A Critical Security Advisory

Bitfinex Hacker Ilya Lichtenstein Sentenced to Five Years for $4.5 Billion Crypto Heist

Summary:

Reference Links(if available):

CVSS Score (if available)

Links to Exploits(if available)

You may have missed

Ransomware Groups Exploit Cloud Services for Data Exfiltration and Attacks

Zero-Day Vulnerability Discovered by watchTowr in Fortinet Products

O2’s Innovative AI Granny Tackles Scam Callers with Engaging Tales

Palo Alto Networks Zero-Day Vulnerability Actively Exploited: A Critical Security Advisory

Bitfinex Hacker Ilya Lichtenstein Sentenced to Five Years for $4.5 Billion Crypto Heist