Description
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bouncycastle | 1.65-2 | — |
| Debian 13 | bouncycastle | 1.65-2 | — |
| Debian 12 | bouncycastle | 1.65-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-3.SP1_redhat_00001.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-avro | 1.7.6-2.redhat_00003.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-bouncycastle +3 | 1.68.0-1.redhat_00005.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-h2database | 1.4.197-2.redhat_00005.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-marshalling +1 | 2.0.15-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.10-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.8-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xalan-j2 | 2.7.1-26.redhat_00015.1.ep7.el7 | RHSA-2024:10208 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-9.redhat_00019.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.68.0-1.redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-guava +1 | 30.1.0-1.redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-guava-failureaccess | 1.0.1-1.redhat_00002.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.13-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.27-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.39-1.SP1_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.18-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.20-2.SP1_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-5.Final_redhat_00006.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.11-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.34-1.SP1_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.6-1.GA_redhat_00002.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.11-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.25-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.6-1.GA_redhat_00002.1.el7eap | RHSA-2021:0873 |
| Red Hat JBoss EAP 7 | eap7-wildfly-naming-client | 1.0.14-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bouncycastle | 1.68-3.2 | openSUSE-SU-2024:10661-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
kurenaif/CVE-2020-28052_PoC ★ 0 · Jan 4, 2021
-
madstap/bouncy-castle-generative-test-poc ★ 0 · Dec 19, 2020
A generative test that would've caught CVE-2020-28052
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.bouncycastle:bcprov-ext-jdk15on | >= 1.65, < 1.67 | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-ext-jdk16 | >= 1.65, < 1.67 | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-jdk14 | >= 1.65, < 1.67 | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-jdk15 | >= 1.65, < 1.67 | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-jdk15on | >= 1.65, < 1.67 | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-jdk15to18 | >= 1.65, < 1.67 | 1.67 | GHSA-73xv-w5gp-frxh |
| Maven | org.bouncycastle:bcprov-jdk16 | >= 1.65, < 1.67 | 1.67 | GHSA-73xv-w5gp-frxh |
Advisories 6
- RHSA-2024:10208 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2021:0873 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0874 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0872 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- openSUSE-SU-2024:10661-1 bouncycastle-1.68-3.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1272 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2025
References
- https://www.bouncycastle.org/releasenotes.html
- [druid-commits] 20210107 [GitHub] [druid] jon-wei opened a new pull request #10733: Update deps for CVE-2020-28168 and CVE-2020-28052 mailing-list
- [kafka-jira] 20210107 [GitHub] [kafka] cyrusv opened a new pull request #9845: MINOR: Bump Bouncy Castle Dep to resolve CVE-2020-28052 mailing-list
- [druid-commits] 20210107 [GitHub] [druid] clintropolis merged pull request #10733: Update deps for CVE-2020-28168 and CVE-2020-28052 mailing-list
- [pulsar-commits] 20210119 [GitHub] [pulsar] fmiguelez opened a new issue #9235: Upgrade Bounce Castle dependency on client to solve CVE-2020-28052 mailing-list
- [druid-commits] 20210127 [druid] 01/02: Update deps for CVE-2020-28168 and CVE-2020-28052 (#10733) mailing-list
- [pulsar-commits] 20210406 [GitHub] [pulsar] lhotari commented on issue #9235: Upgrade Bounce Castle dependency on client to solve CVE-2020-28052 mailing-list
- [solr-issues] 20210525 [jira] [Created] (SOLR-15431) Security vulnerability with Bouncy Castle library within Apache Solr 8.8.2 mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://github.com/bcgit/bc-java/wiki/CVE-2020-28052
- https://www.synopsys.com/blogs/software-security/cve-2020-28052-bouncy-castle/
- https://www.oracle.com//security-alerts/cpujul2021.html
- [karaf-issues] 20210810 [jira] [Created] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052 mailing-list
- [karaf-issues] 20210810 [jira] [Updated] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052 mailing-list
- [karaf-issues] 20210810 [jira] [Commented] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052 mailing-list
- [karaf-issues] 20210816 [jira] [Updated] (KARAF-7240) Upgrade bcprov artifacts to mitigate CVE-2020-28052 mailing-list
- [karaf-issues] 20210816 [jira] [Updated] (KARAF-7240) Upgrade bcprov 1.69 artifacts to mitigate CVE-2020-28052 mailing-list
- [karaf-issues] 20210817 [jira] [Commented] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052 mailing-list
- [karaf-issues] 20210817 [jira] [Updated] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052 mailing-list
- [karaf-issues] 20210820 [jira] [Updated] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052 mailing-list
- [karaf-issues] 20210824 [jira] [Commented] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052 mailing-list
- [karaf-issues] 20210824 [jira] [Resolved] (KARAF-7240) Upgrade bcprov 1.68 artifacts to mitigate CVE-2020-28052 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html