CVE & CISA-KEV Catalog

CVE-2020-28052

HIGHEPSS 94th pctl
8.1
CVSS v3
NVD

Description

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

How to fix

Remediation Available
bouncycastleDebian
Fixed in:1.65-2CVE-2020-28052
Fixed in:1.65-2CVE-2020-28052
Fixed in:1.65-2CVE-2020-28052
Fixed in:1.65-2CVE-2020-28052
eap7-apache-cxfRed Hat / RHEL
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxfRocky
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-rtRocky
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-rtRed Hat / RHEL
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-servicesRocky
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-servicesRed Hat / RHEL
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-toolsRed Hat / RHEL
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-toolsRocky
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-avroRocky
Fixed in:0:1.7.6-2.redhat_00003.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.7.6-2.redhat_00003.1.ep7.el7RHSA-2024:10208
eap7-avroRed Hat / RHEL
Fixed in:0:1.7.6-2.redhat_00003.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.7.6-2.redhat_00003.1.ep7.el7RHSA-2024:10208
eap7-bouncycastleRed Hat / RHEL
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastleRocky
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-mailRed Hat / RHEL
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-mailRocky
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-pkixRed Hat / RHEL
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-pkixRocky
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-provRocky
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-provRed Hat / RHEL
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-h2databaseRed Hat / RHEL
Fixed in:0:1.4.197-2.redhat_00005.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.4.197-2.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-h2databaseRocky
Fixed in:0:1.4.197-2.redhat_00005.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.4.197-2.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-jackson-databindRed Hat / RHEL
Fixed in:0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jackson-databindRocky
Fixed in:0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-marshallingRed Hat / RHEL
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-marshallingRocky
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-marshalling-riverRed Hat / RHEL
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-marshalling-riverRocky
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-xnio-baseRed Hat / RHEL
Fixed in:0:3.5.10-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:3.5.10-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-xnio-baseRocky
Fixed in:0:3.5.10-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:3.5.10-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-wildflyRocky
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
eap7-wildflyRed Hat / RHEL
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
eap7-wildfly-modulesRed Hat / RHEL
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
eap7-wildfly-modulesRocky
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
eap7-xalan-j2Red Hat / RHEL
Fixed in:0:2.7.1-26.redhat_00015.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.7.1-26.redhat_00015.1.ep7.el7RHSA-2024:10208
eap7-xalan-j2Rocky
Fixed in:0:2.7.1-26.redhat_00015.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.7.1-26.redhat_00015.1.ep7.el7RHSA-2024:10208

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

7.14%probability of exploitation in 30 days
94thpercentile

High risk: more likely to be exploited than 94% of all known CVEs.

References

Exploit1
Vendor Advisory1
Embed a live status badge for CVE-2020-28052
CVE-2020-28052 severity badge

Markdown

[![CVE-2020-28052](https://tridentstack.com/cve/badge/CVE-2020-28052.svg)](https://tridentstack.com/cve/CVE-2020-28052)

HTML

<a href="https://tridentstack.com/cve/CVE-2020-28052"><img src="https://tridentstack.com/cve/badge/CVE-2020-28052.svg" alt="CVE-2020-28052"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-05-12.