What’s Vulnerable › Vulnerabilities
CVE-2020-28052
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 7.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-12-18 · updated 2026-06-17
Description
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Affected products
- Apache Software Foundation Apache Karaf: 4.3.2
- Legion of the Bouncy Castle Inc. BC-JAVA: 1.65, 1.66
- Oracle Banking Corporate Lending Process Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Banking Credit Facilities Process Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Banking Extensibility Workbench: 14.2.0, 14.3.0, 14.5.0
- Oracle Banking Supply Chain Finance: 14.2.0, 14.3.0, 14.5.0
- Oracle Corporation Banking Virtual Account Management: 14.2.0, 14.3.0, 14.5.0
- Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Communications Application Session Controller: 3.9m0p3
- Oracle Communications Cloud Native Core Network Slice Selection Function: 1.2.1
- Oracle Corporation Communications Convergence: 3.0.2.2.0
- Oracle Communications Messaging Server: 8.0.2, 8.1
- Oracle Corporation Communications Pricing Design Center: 12.0.0.3.0
- Oracle Communications Session Report Manager: from 8.0.0 through 8.2.4.0
- Oracle Communications Session Route Manager: from 8.2.0 through 8.2.4
- Oracle Corporation JD Edwards EnterpriseOne Tools: through 9.2.5.3
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.56, 8.57, 8.58
- Oracle Corporation Utilities Framework: 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0
- Oracle Corporation Oracle WebCenter Portal: 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
How to fix
Upgrade to a fixed version: Oracle Blockchain Platform 21.1.2. Check the vendor advisory for mitigations.
References
- https://github.com/bcgit/bc-java/wiki/CVE-2020-28052
- https://lists.apache.org/thread.html/r167dbc42ef7c59802c2ca1ac14735ef9cf687c25208229993d6206fe%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r175f5a25d100dbe2b1bd3459b3ce882a84c3ff91b120ed4ff2d57b53%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4a%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r2ddabd06d94b60cfb0141e4abb23201c628ab925e30742f61a04d013%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r30a139c165b3da6e0d5536434ab1550534011b1fdfcd2f5d95892c5b%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r37d332c0bf772f4982d1fdeeb2f88dd71dab6451213e69e43734eadc%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r4e1619cfefcd031fac62064a3858f5c9229eef907bd5d8ef14c594fc%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r77af3ac7c3bfbd5454546e13faf7aec21d627bdcf36c9ca240436b94%40%3Cissues.karaf.apache.org%3E
- https://lists.apache.org/thread.html/r8c36ba34e80e05eecb1f80071cc834d705616f315b634ec0c7d8f42e%40%3Cissues.solr.apache.org%3E
- https://lists.apache.org/thread.html/r954d80fd18e9dafef6e813963eb7e08c228151c2b6268ecd63b35d1f%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rc9e441c1576bdc4375d32526d5cf457226928e9c87b9f54ded26271c%40%3Cissues.karaf.apache.org%3E
Get alerted when CVE-2020-28052 or the next vulnerability affects your stack