CVE-2020-28052: Apache Karaf

High severity, CVSS 8.1. EPSS: 7.2% chance of exploitation in the next 30 days.

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.

Affected products

  • Apache Karaf: version 4.3.2 only
  • Bouncycastle Bc-Java: version 1.65 only; version 1.66 only
  • Oracle Banking Corporate Lending Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Banking Credit Facilities Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Banking Extensibility Workbench: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Banking Supply Chain Finance: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Blockchain Platform: before 21.1.2 (fixed in 21.1.2)
  • Oracle Commerce Guided Search: version 11.3.2 only
  • Oracle Communications Application Session Controller: version 3.9m0p3 only
  • Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.2.1 only
  • Oracle Communications Convergence: version 3.0.2.2.0 only
  • Oracle Communications Messaging Server: version 8.0.2 only; version 8.1 only
  • Oracle Communications Pricing Design Center: version 12.0.0.3.0 only
  • Oracle Communications Session Report Manager: from 8.0.0, up to and including 8.2.4.0
  • Oracle Communications Session Route Manager: from 8.2.0, up to and including 8.2.4
  • Oracle Jd Edwards Enterpriseone Tools: up to and including 9.2.5.3
  • Oracle PeopleSoft Enterprise PeopleTools: version 8.56 only; version 8.57 only; version 8.58 only
  • Oracle Utilities Framework: version 4.3.0.6.0 only; version 4.4.0.0.0 only; version 4.4.0.2.0 only; version 4.4.0.3.0 only
  • Oracle Webcenter Portal: version 11.1.1.9.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2020-12-18. Last modified 2026-06-17.