760729 – (CVE-2020-28052) <dev-java/bcprov-1.69: Invalid password comparison logic for bcrypt (CVE-2020-28052)

Bug 760729 (CVE-2020-28052) - <dev-java/bcprov-1.69: Invalid password comparison logic for bcrypt (CVE-2020-28052)

Summary: <dev-java/bcprov-1.69: Invalid password comparison logic for bcrypt (CVE-2020...

Status:	IN_PROGRESS

Alias:	CVE-2020-28052

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	http://www.synopsys.com/blogs/softwar...
Whiteboard:	B3 [glsa? cleanup]
Keywords:	PullRequest

Depends on:	799749 820428
Blocks:
	Show dependency tree

Reported:	2020-12-19 14:32 UTC by Sam James
Modified:	2021-12-01 10:53 UTC (History)
CC List:	2 users (show)

See Also:	CVE-2016-1000338, CVE-2016-1000339, CVE-2016-1000340, CVE-2016-1000341, CVE-2016-1000342, CVE-2016-1000343, CVE-2016-1000344, CVE-2016-1000352, CVE-2017-13098, CVE-2018-1000180, CVE-2018-1000613 https://github.com/gentoo/gentoo/pull/21479
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2020-12-19 14:32:33 UTC

We need to work through the rdeps once bumped.

Comment 1 Sam James archtester

2020-12-19 14:33:34 UTC

Please bump to 1.67 and we'll go from there re revdeps.

Comment 2 Larry the Git Cow gentoo-dev

2021-07-09 13:13:59 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dfe4c8498cf254cfdd4833fe2640e9b16afea15a

commit dfe4c8498cf254cfdd4833fe2640e9b16afea15a
Author:     Volkmar W. Pogatzki <gentoo@pogatzki.net>
AuthorDate: 2021-06-22 12:41:52 +0000
Commit:     Miroslav Šulc <fordfrog@gentoo.org>
CommitDate: 2021-07-09 13:02:02 +0000

    dev-java/bcprov: bump to 1.69
    
    Bug: https://bugs.gentoo.org/797634
    Bug: https://bugs.gentoo.org/760729
    
    Package-Manager: Portage-3.0.20, Repoman-3.0.2
    Signed-off-by: Volkmar W. Pogatzki <gentoo@pogatzki.net>
    Closes: https://github.com/gentoo/gentoo/pull/21479/commits/0357e38e7a6ac560da6e6de9c29bc40c3b5cd7eb
    Signed-off-by: Miroslav Šulc <fordfrog@gentoo.org>

 dev-java/bcprov/Manifest           |  1 +
 dev-java/bcprov/bcprov-1.69.ebuild | 78 ++++++++++++++++++++++++++++++++++++++
 dev-java/bcprov/metadata.xml       |  3 ++
 3 files changed, 82 insertions(+)

Comment 3 Miroslav Šulc gentoo-dev

2021-07-09 16:07:20 UTC

should be safe to stabilize, it passes all tests.

Comment 4 NATTkA bot gentoo-dev

2021-10-27 02:13:02 UTC

Resetting sanity check; package list is empty or all packages are done.

Comment 5 John Helmert III archtester

2021-10-27 02:15:06 UTC

I went ahead and popped stabilization out from here to keep the blockers since they were unrelated to the stabilization

Comment 6 John Helmert III archtester

2021-11-26 05:07:17 UTC

Please cleanup

Comment 7 Miroslav Šulc gentoo-dev

2021-11-26 08:10:48 UTC

we still need to resolve packages that depend on bcprov:1.50