CVE-2015-0886 Integer Overflow or Wraparound in JBCrypt
An integer overflow in jBCrypt allows remote attackers to more easily determine cleartext passwords via brute-force attacks on specific hashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-0886?
CVE-2015-0886 is a medium-severity vulnerability in Fedoraproject Fedora, published on 28 Feb 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.
Weakness: CWE-190
Which versions are affected by CVE-2015-0886?
2 open source packages ship an affected version, including org.mindrot:jbcrypt. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.mindrot:jbcrypt Maven | All versions | 0.4 |
org.mindrot:jbcrypt Maven | All versions | 0.4 |
Products include Fedoraproject Fedora, Mindrot Jbcrypt.
How do I fix CVE-2015-0886?
Upgrade org.mindrot:jbcrypt to 0.4 or later.
Is CVE-2015-0886 being exploited?
There is no known exploitation of CVE-2015-0886 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as CLEANSTART-2026-ER14083, CLEANSTART-2026-RJ10234, DEBIAN-CVE-2015-0886, GHSA-9h6p-92jq-888x.