~ / search / GHSA-vjwc-5hfh-2vv5

GHSA-vjwc-5hfh-2vv5

Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

Source: GitHub Advisory Database (reviewed) High CVE-2015-0226

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.ws.security:wss4j < 1.6.17 1.6.17
Maven org.apache.wss4j:wss4j-ws-security-dom >= 2.0.0, < 2.0.2 2.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

References

External links from the advisory. They lead to third-party sites.