SB2020121801 - Incorrect password hashing algorithm in Bouncy Castle

Description

This security bulletin contains information about 1 security vulnerability.

1) Comparison using wrong factors (CVE-ID: CVE-2020-28052)

The vulnerability allows a remote attacker to brute-force password hashes.

The vulnerability exists due to comparison error in OpenBSDBCrypt.checkPassword() function in core/src/main/java/org/bouncycastle/crypto/generators/OpenBSDBCrypt.java when matching passwords with hashes. A remote attacker can pass an incorrect password that will be accepted as a valid one by the library, bypass authentication process and gain unauthorized access to the application that uses vulnerable version of Bouncy Castle.

Remediation

Install update from vendor's website.

References

• https://github.com/bcgit/bc-java/wiki/CVE-2020-28052
• https://www.bouncycastle.org/releasenotes.html
• https://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle/