CVEvulnerability

CVE-2015-0226

7.5 HIGH Published 2017-10-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-10-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-327

Description

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

Affected configurations

• apache wss4j (<= 1.6.16) • apache wss4j 2.0 • apache wss4j 2.0.0 • apache wss4j 2.0.1

Related

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References