In December 2020, a vulnerability in the Bouncy Castle cryptographic library was publicly revealed. This vulnerability was discovered in October and fixed in November 2020. However, the nature of supply chain vulnerabilities means that many organizations remain vulnerable months later.
Inside the Bouncy Castle Vulnerability
The Bouncy Castle vulnerability was a flaw in the implementation of the OpenBSDBcrypt.doCheckPassword() function. The purpose of this function is to compare the hash of a password submitted during user authentication with a hash stored by the system. If these hashes match, then the user authenticates successfully.