CVE-2015-0886
Medium
Description
Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.
SeverityMedium
CVSS5.0
Exploit probability—
Product
Mindrot Jbcrypt
PublishedFeb 28, 2015
First seenFeb 28, 2015
How to fix
Update
- mindrot jbcrypt0.4 or later
- org.mindrot:jbcrypt0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mindrot jbcrypt | v < 0.4 | 0.4 |
| fedoraproject fedora | 20, 21, 22 | — |
| org.mindrot:jbcryptMaven | v < 0.4 | 0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.