Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
patrickfav/bcrypt
main @ d068562
4
Fixes
0
CVEs
MEDIUM
Peak severity
Highlights
Cryptographic Issues: 2 prior fixes. Scrutinize any change in this area.
modules/bcrypt/src/main/java/at/favre/lib/crypto/bcrypt/BCrypt.java: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cryptographic Issues: A logic flaw in configuration mapping caused the Hasher to incorrectly apply the default version's long-password strategy instead of the user-specified version's strategy, potentially breaking compatibility or weakening intended constraints.
Auth Bypass: Hash verification routines bypassed the intended algorithm variant checks by defaulting to the $2a$ version rather than checking the hash's actual prefix (e.g., $2y$, $2b$), which could result in incorrect verification or security degradation.
Cryptographic Issues: A missing bitmask during Radix64 decoding allowed sign extension to corrupt decoded byte values when bit-shifting them into words, resulting in cryptographic errors.