JVN#77718330: Vulnerability in the jBCrypt key stretching process

jBCrypt is a Java implementation to compute password hashes. jBCrypt contains an integer overflow vulnerability in the key stretching process. An integer overflow occurs when the parameter for the repetition count is set to the maximum value allowed, 31.

Impact

When the hash value for a password is obtained by a remote attacker, a brute force attack may be used to easily recover the password.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• jBCrypt-0.3 and earlier