GHSA-73xv-w5gp-frxh

Suggest an improvement
Source
https://github.com/advisories/GHSA-73xv-w5gp-frxh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-73xv-w5gp-frxh/GHSA-73xv-w5gp-frxh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-73xv-w5gp-frxh
Aliases
Published
2021-04-30T16:14:15Z
Modified
2024-03-08T05:18:41.838529Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Logic error in Legion of the Bouncy Castle BC Java
Details

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

Database specific 
{
    "nvd_published_at": "2020-12-18T01:15:00Z",
    "cwe_ids": [
        "CWE-670"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-19T00:15:55Z"
}
References

Affected packages

Maven / org.bouncycastle:bcprov-jdk15to18

Package

Name
org.bouncycastle:bcprov-jdk15to18
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk15to18

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.65
Fixed
1.67

Affected versions

1.*

1.65
1.66

Maven / org.bouncycastle:bcprov-jdk15

Package

Name
org.bouncycastle:bcprov-jdk15
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk15

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.65
Fixed
1.67

Maven / org.bouncycastle:bcprov-jdk15on

Package

Name
org.bouncycastle:bcprov-jdk15on
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk15on

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.65
Fixed
1.67

Affected versions

1.*

1.65
1.65.01
1.66

Maven / org.bouncycastle:bcprov-ext-jdk15on

Package

Name
org.bouncycastle:bcprov-ext-jdk15on
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-ext-jdk15on

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.65
Fixed
1.67

Affected versions

1.*

1.65
1.66

Maven / org.bouncycastle:bcprov-jdk14

Package

Name
org.bouncycastle:bcprov-jdk14
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk14

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.65
Fixed
1.67

Affected versions

1.*

1.65

Maven / org.bouncycastle:bcprov-jdk16

Package

Name
org.bouncycastle:bcprov-jdk16
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-jdk16

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.65
Fixed
1.67

Maven / org.bouncycastle:bcprov-ext-jdk16

Package

Name
org.bouncycastle:bcprov-ext-jdk16
View open source insights on deps.dev
Purl
pkg:maven/org.bouncycastle/bcprov-ext-jdk16

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.65
Fixed
1.67