CVE-2020-7226
mediumpriority · track · 31EPSS 0.033 · 89 %ileDEEUUSEPSS · scored 2026-10-23
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (20)
Products and version ranges known to be affected.
- Red Hat JBoss Enterprise Application Platform 7.2all versionscert_bundDEcpe:/a:redhat:jboss_enterprise_application_platform:7.2
- Red Hat JBoss Enterprise Application Platform 7.2_EL6all versionscert_bundDEcpe:/a:redhat:jboss_enterprise_application_platform:7.2_el6
- Red Hat JBoss Enterprise Application Platform 7.2_EL7all versionscert_bundDEcpe:/a:redhat:jboss_enterprise_application_platform:7.2_el7
- Red Hat JBoss Enterprise Application Platform 7.2_EL8all versionscert_bundDEcpe:/a:redhat:jboss_enterprise_application_platform:7.2_el8
- oracle communications services gatekeeper= 7.0nvdUScpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-1375JFrog Artifactory: Mehrere SchwachstellenDeutsch2022-09-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
- WID-SEC-W-2024-2180Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2022-04-19csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-0227IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2021-11-30csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um seine Privilegien zu erweitern, Administratorrechte zu erlangen, beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2025-2123Red Hat JBoss Enterprise Application Platform: Mehrere SchwachstellenDeutsch2020-05-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Angriff durchzuführen, einen Denial of Service Zustand herbeizuführen, Informationen offenzulegen oder Dateien zu manipulieren.
- GHSA-x64g-4xx9-fh6xDenial of Service in Cryptacular2020-06-10ghsa · osvUS
CiphertextHeader.java in Cryptacular before 1.2.4, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (75)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2020-7226cnnvd
- https://github.com/apereo/cas/commit/8810f2b6c71d73341d4dde6b09a18eb46cfd6d45cnnvd
- https://github.com/apereo/cas/commit/93b1c3e9d90e36a19d0fa0f6efb863c6f0235e75cnnvd
- https://github.com/apereo/cas/commit/a042808d6adbbf44753d52c55cac5f533e24101fcnnvd
- https://github.com/apereo/cas/pull/4685cnnvd
- https://github.com/vt-middleware/cryptacular/blob/fafccd07ab1214e3588a35afe3c361519129605f/src/main/java/org/cryptacular/CiphertextHeader.java#L153cnnvd
- https://github.com/vt-middleware/cryptacular/blob/master/src/main/java/org/cryptacular/CiphertextHeader.java#L153cnnvd
- https://github.com/vt-middleware/cryptacular/issues/52cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan