High severity · published Dec 18, 2020
CVE-2020-28052
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66
8.1
CVSS
7.2%
EPSS
No
On KEV
Description
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.2% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Banking Corporate Lending Process Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BC
Banking Credit Facilities Process Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BE
Banking Extensibility Workbench · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BS
Banking Supply Chain Finance · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BV
Banking Virtual Account Management · Oracle
14.2.0; 14.3.0; 14.5.0 · source: NVD
BC
Bc-java · Bouncycastle
1.65; 1.66 · source: NVD
BP
Blockchain Platform · Oracle
before 21.1.2 · source: NVD
CG
Commerce Guided Search · Oracle
11.3.2 · source: NVD
CA
Communications Application Session Controller · Oracle
3.9m0p3 · source: NVD
CC
Communications Cloud Native Core Network Slice Selection Function · Oracle
1.2.1 · source: NVD
CC
Communications Convergence · Oracle
3.0.2.2.0 · source: NVD
CM
Communications Messaging Server · Oracle
8.0.2; 8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-28052
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-28052
Mitigation
https://github.com/bcgit/bc-java/wiki/CVE-2020-28052
lists.apache.org
https://lists.apache.org/thread.html/r167dbc42ef7c59802c2ca1ac14735ef9cf687c25208229993d6206fe%40%3Cissues.karaf.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r175f5a25d100dbe2b1bd3459b3ce882a84c3ff91b120ed4ff2d57b53%40%3Ccommits.pulsar.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4a%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r2ddabd06d94b60cfb0141e4abb23201c628ab925e30742f61a04d013%40%3Cissues.karaf.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r30a139c165b3da6e0d5536434ab1550534011b1fdfcd2f5d95892c5b%40%3Cissues.karaf.apache.org%3E
More from Karaf
9.8
CVE-2026-91048
Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
9.8
CVE-2026-91012
Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
9.8
CVE-2022-40145
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL
9.8
CVE-2018-11788
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder
8.8
CVE-2026-92142
Apache Karaf: Authorization bypass in JMX MBean lifecycle operations