Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-0226US | high7.5OT elevated | — | ||
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for… | ||||
02
references
External citations — patches, advisories, analysis.
- http://rhn.redhat.com/errata/RHSA-2015-0846.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0847.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0848.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-0849.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-1176.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-1177.htmlWEB
- https://access.redhat.com/errata/RHSA-2016:1376WEB
- https://github.com/apache/ws-wss4jPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan