CVE-2015-0886 Integer Overflow or Wraparound in JBCrypt
MediumCVSS 5.0
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.mindrot/jbcrypt(Maven) | < 0.4 | 0.4 |
| debian/libjbcrypt-java(Debian:12) | < 0.4-1 | 0.4-1 |
| debian/libjbcrypt-java(Debian:14) | < 0.4-1 | 0.4-1 |
| debian/libjbcrypt-java(Debian:13) | < 0.4-1 | 0.4-1 |
| org.mindrot/jbcrypt(Maven) | = 0.3m | No fix listed |
| mindrot jbcrypt | < 0.4 | 0.4 |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.mindrot.org issue-tracking vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- JVN#77718330 third-party-advisory vendor-advisory
- JVNDB-2015-000033 third-party-advisory vdb-entry vendor-advisory
- FEDORA-2015-3120 third-party-advisory vendor-advisory
- FEDORA-2015-3032 third-party-advisory vendor-advisory
- FEDORA-2015-2994 third-party-advisory vendor-advisory
- www.mindrot.org release-notes vendor-advisory
- github.com
- Debian Security Tracker CVE-2015-0886 vendor-advisory
- bugs.debian.org issue-tracking
- [cassandra-commits] 20210924 [jira] [Commented] (CASSANDRA-16990) Update jbcrypt library to 0.4 from 0.3m to resolve CVE-2015-0886 mailing-list
- [cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-16990) Update jbcrypt library to 0.4 from 0.3m to resolve CVE-2015-0886 mailing-list
- [cassandra-commits] 20210924 [jira] [Created] (CASSANDRA-16990) Update jbcrypt library to 0.4 from 0.3m to resolve CVE-2015-0886 mailing-list