An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66.
Priority MEDIUM 45CWE-670Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 12 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Why it matters now
EPSS 0.07225 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.bouncycastle:bcprov-jdk15to18 (Maven): 1.67org.bouncycastle:bcprov-jdk15 (Maven): 1.67+5 more productsRed Hat: 12 advisoriesRed Hat: 12 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.bouncycastle:bcprov-jdk15to18 (Maven) | 1.65 to before 1.67 | 1.67 | Patch available | GHSA-73xv-w5gp-frxh |
| — | org.bouncycastle:bcprov-jdk15 (Maven) | 1.65 to before 1.67 | 1.67 | Patch available | GHSA-73xv-w5gp-frxh |
| — | org.bouncycastle:bcprov-jdk15on (Maven) | 1.65 to before 1.67 | 1.67 | Patch available | GHSA-73xv-w5gp-frxh |
| — | org.bouncycastle:bcprov-ext-jdk15on (Maven) | 1.65 to before 1.67 | 1.67 | Patch available | GHSA-73xv-w5gp-frxh |
| — | org.bouncycastle:bcprov-jdk14 (Maven) | 1.65 to before 1.67 | 1.67 | Patch available | GHSA-73xv-w5gp-frxh |
| — | org.bouncycastle:bcprov-jdk16 (Maven) | 1.65 to before 1.67 | 1.67 | Patch available | GHSA-73xv-w5gp-frxh |
| — | org.bouncycastle:bcprov-ext-jdk16 (Maven) | 1.65 to before 1.67 | 1.67 | Patch available | GHSA-73xv-w5gp-frxh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.bouncycastle:bcprov-jdk15to18 (Maven) Vendor— Affected 1.65 to before 1.67 Fixed in 1.67 Patch available GHSA-73xv-w5gp-frxh
- org.bouncycastle:bcprov-jdk15 (Maven) Vendor— Affected 1.65 to before 1.67 Fixed in 1.67 Patch available GHSA-73xv-w5gp-frxh
- org.bouncycastle:bcprov-jdk15on (Maven) Vendor— Affected 1.65 to before 1.67 Fixed in 1.67 Patch available GHSA-73xv-w5gp-frxh
- org.bouncycastle:bcprov-ext-jdk15on (Maven) Vendor— Affected 1.65 to before 1.67 Fixed in 1.67 Patch available GHSA-73xv-w5gp-frxh
- org.bouncycastle:bcprov-jdk14 (Maven) Vendor— Affected 1.65 to before 1.67 Fixed in 1.67 Patch available GHSA-73xv-w5gp-frxh
- org.bouncycastle:bcprov-jdk16 (Maven) Vendor— Affected 1.65 to before 1.67 Fixed in 1.67 Patch available GHSA-73xv-w5gp-frxh
- org.bouncycastle:bcprov-ext-jdk16 (Maven) Vendor— Affected 1.65 to before 1.67 Fixed in 1.67 Patch available GHSA-73xv-w5gp-frxh
CPE configurations NVD · 39
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bouncycastle:bc-java:1.65:*:*:*:*:*:*:* | 1.65 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:bouncycastle:bc-java:1.66:*:*:*:*:*:*:* | 1.66 | Vulnerable | Legion of the Bouncy Castle Inc. |
| cpe:2.3:a:apache:karaf:4.3.2:*:*:*:*:*:*:* | 4.3.2 | Vulnerable | Apache |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
- cpe:2.3:a:bouncycastle:bc-java:1.65:*:*:*:*:*:*:* Versions 1.65 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:bouncycastle:bc-java:1.66:*:*:*:*:*:*:* Versions 1.66 Vulnerable ·Legion of the Bouncy Castle Inc.
- cpe:2.3:a:apache:karaf:4.3.2:*:*:*:*:*:*:* Versions 4.3.2 Vulnerable ·Apache
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
Show 29 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* | before 21.1.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* | 11.3.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p3:*:*:*:*:*:*:* | 3.9m0p3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:* | 3.0.2.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* | 12.0.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* | 8.0.0 – 8.2.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* | 8.2.0 – 8.2.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* | up to 9.2.5.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* | 8.56 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* | 8.57 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:* | 4.3.0.6.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* | 4.4.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* | 4.4.0.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* | 4.4.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:* | 11.1.1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:* | 8.0.2 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p3:*:*:*:*:*:*:* Versions 3.9m0p3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:* Versions 3.0.2.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.2.0 – 8.2.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions up to 9.2.5.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.3.0.6.0:*:*:*:*:*:*:* Versions 4.3.0.6.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:* Versions 4.4.0.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.3.0:*:*:*:*:*:*:* Versions 4.4.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:* Versions 11.1.1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:o:oracle:communications_messaging_server:8.0.2:*:*:*:*:*:*:* Versions 8.0.2 Vulnerable ·Oracle
- cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
Remediation
- Fix · GHSA-73xv-w5gp-frxh org.bouncycastle:bcprov-jdk15to18 (Maven) Fixed in 1.67 Advisory →
- Fix · GHSA-73xv-w5gp-frxh org.bouncycastle:bcprov-jdk15 (Maven) Fixed in 1.67 Advisory →
- Fix · GHSA-73xv-w5gp-frxh org.bouncycastle:bcprov-jdk15on (Maven) Fixed in 1.67 Advisory →
- Fix · GHSA-73xv-w5gp-frxh org.bouncycastle:bcprov-ext-jdk15on (Maven) Fixed in 1.67 Advisory →
- Fix · GHSA-73xv-w5gp-frxh org.bouncycastle:bcprov-jdk14 (Maven) Fixed in 1.67 Advisory →
- Fix · GHSA-73xv-w5gp-frxh org.bouncycastle:bcprov-jdk16 (Maven) Fixed in 1.67 Advisory →
- Fix · GHSA-73xv-w5gp-frxh org.bouncycastle:bcprov-ext-jdk16 (Maven) Fixed in 1.67 Advisory →
Red Hat 12 advisories
- RHSA-2024:10208 Released 2024-11-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-services-3.1.16-3.SP1_redhat_00001.1.ep7.el7 +14
- RHSA-2021:4767 Released 2021-11-23 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus GA security update
- Red Hat Integration Camel Quarkus 2
- RHSA-2021:3205 Released 2021-08-18 · Red Hat rating ModerateRed Hat Integration Camel-K 1.4 release and security update
- Red Hat Integration
Show 9 more Red Hat advisories
- RHSA-2021:3140 Released 2021-08-11 · Red Hat rating ModerateRed Hat Fuse 7.9.0 release and security update
- Red Hat Fuse 7.9
- RHSA-2021:2755 Released 2021-07-15 · Red Hat rating ModerateEAP XP 2 security update to CVE fixes in the EAP 7.3.x base
- Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
- RHSA-2021:2210 Released 2021-06-02 · Red Hat rating ModerateEAP XP 1 security update to CVE fixes in the EAP 7.3.x base
- Red Hat EAP-XP via EAP 7.3.x base
- RHSA-2021:1401 Released 2021-04-27 · Red Hat rating ModerateRed Hat Fuse 7.8.1 patch release and security update
- Red Hat Fuse 7.8.1
- RHSA-2021:0974 Released 2021-03-23 · Red Hat rating ModerateRed Hat Single Sign-On 7.4.6 security update
- Red Hat Single Sign-On 7.4.6
- RHSA-2021:0872 Released 2021-03-16 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.6 security update
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el6eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el6eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el6eap +47
- RHSA-2021:0874 Released 2021-03-16 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.6 security update
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el8eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el8eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el8eap +47
- RHSA-2021:0873 Released 2021-03-16 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.6 security update
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-9.redhat_00019.1.el7eap, eap7-activemq-artemis-cli-2.9.0-9.redhat_00019.1.el7eap, eap7-activemq-artemis-commons-2.9.0-9.redhat_00019.1.el7eap +47
- RHSA-2021:0885 Released 2021-03-16 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.3.6 security update
- Red Hat JBoss Enterprise Application Platform 7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat EAP-XP 2.0.0 via EAP 7.3.x base | Fixed | RHSA-2021:2755 |
| Red Hat EAP-XP via EAP 7.3.x base | Fixed | RHSA-2021:2210 |
| Red Hat Fuse 7.8.1 | Fixed | RHSA-2021:1401 |
| Red Hat Fuse 7.9 | Fixed | RHSA-2021:3140 |
| Red Hat Integration | Fixed | RHSA-2021:3205 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:4767 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2021:0874 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2021:0872 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2021:0873 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2021:0885 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2024:10208 |
| Red Hat Single Sign-On 7.4.6 | Fixed | RHSA-2021:0974 |
Not affected: 7 products
- Red Hat Decision Manager 7
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
- Red Hat OpenShift Application Runtimes
- Red Hat Process Automation 7
- Red Hat Virtualization 4
- Red Hat build of Quarkus
- Red Hat support for Spring Boot
Timeline
- 2026-10-02 Threatist record created from CVE-2020-28052
- 2026-10-03 Alias added: GHSA-73xv-w5gp-frxh
References
Patch 7
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://github.com/bcgit/bc-java/wiki/CVE-2020-28052
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Advisory 2
Other 37
- [druid-commits] 20210107 [GitHub] [druid] jon-wei opened a new pull request #10733: Update deps for CVE-2020-28168 and CVE-2020-28052
- [kafka-jira] 20210107 [GitHub] [kafka] cyrusv opened a new pull request #9845: MINOR: Bump Bouncy Castle Dep to resolve CVE-2020-28052
- [druid-commits] 20210107 [GitHub] [druid] clintropolis merged pull request #10733: Update deps for CVE-2020-28168 and CVE-2020-28052
- [pulsar-commits] 20210119 [GitHub] [pulsar] fmiguelez opened a new issue #9235: Upgrade Bounce Castle dependency on client to solve CVE-2020-28052
- [druid-commits] 20210127 [druid] 01/02: Update deps for CVE-2020-28168 and CVE-2020-28052 (#10733)
- [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari commented on issue #9235: Upgrade Bounce Castle dependency on client to solve CVE-2020-28052
- [solr-issues] 20210525 [jira] [Created] (SOLR-15431) Security vulnerability with Bouncy Castle library within Apache Solr 8.8.2
- [karaf-issues] 20210810 [jira] [Created] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052
- [karaf-issues] 20210810 [jira] [Updated] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052
- [karaf-issues] 20210810 [jira] [Commented] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052
- [karaf-issues] 20210816 [jira] [Updated] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052
- [karaf-issues] 20210816 [jira] [Updated] (KARAF-7240) Upgrade bcprov 1.69 artifacts to mitigate CVE-2020-28052
- [karaf-issues] 20210817 [jira] [Commented] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052
- [karaf-issues] 20210817 [jira] [Updated] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052
- [karaf-issues] 20210820 [jira] [Updated] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052
- [karaf-issues] 20210824 [jira] [Commented] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052
- [karaf-issues] 20210824 [jira] [Resolved] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052
- https://github.com/bcgit/bc-java/commit/97578f9b7ed277e6ecb58834e85e3d18385a4219
- https://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle
- https://lists.apache.org/thread.html/rfc0db1f3c375087e69a239f9284ded72d04fbb55849eadde58fa9dc2@%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/rf9abfc0223747a56694825c050cc6b66627a293a32ea926b3de22402@%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/rdfd2901b8b697a3f6e2c9c6ecc688fd90d7f881937affb5144d61d6e@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rddd2237b8636a48d573869006ee809262525efb2b6ffa6eff50d2a2d@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rdcbad6d8ce72c79827ed8c635f9a62dd919bb21c94a0b64cab2efc31@%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/rcd37d9214b08067a2e8f2b5b4fd123a1f8cb6008698d11ef44028c21@%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/rc9e441c1576bdc4375d32526d5cf457226928e9c87b9f54ded26271c@%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r954d80fd18e9dafef6e813963eb7e08c228151c2b6268ecd63b35d1f@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r8c36ba34e80e05eecb1f80071cc834d705616f315b634ec0c7d8f42e@%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r77af3ac7c3bfbd5454546e13faf7aec21d627bdcf36c9ca240436b94@%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r4e1619cfefcd031fac62064a3858f5c9229eef907bd5d8ef14c594fc@%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r37d332c0bf772f4982d1fdeeb2f88dd71dab6451213e69e43734eadc@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r30a139c165b3da6e0d5536434ab1550534011b1fdfcd2f5d95892c5b@%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r2ddabd06d94b60cfb0141e4abb23201c628ab925e30742f61a04d013@%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4a@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r175f5a25d100dbe2b1bd3459b3ce882a84c3ff91b120ed4ff2d57b53@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r167dbc42ef7c59802c2ca1ac14735ef9cf687c25208229993d6206fe@%3Cissues.karaf.apache.org%3E
- https://github.com/bcgit/bc-java
Sources
- CVE-2020-28052 · CVE Program
- CVE-2020-28052 · NVD
- FIRST EPSS
- GHSA-73xv-w5gp-frxh · GitHub Advisory Database · CC BY 4.0
- CVE-2020-28052 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences